sending events from input based on regex to metrics

[imrago]

I have created a setup where from an input based on a regex some of the events are sent to a specific index with changed source type. It is working nicely with regular indexes, but I can not get it working with metrics based indexes. What could be wrong?

props.conf
[csv]
TRANSFORMS-indst = changeindex,changesourcetype

inputs.conf
[udp://514]
connection_host = ip
sourcetype = csv

transforms.conf
[changeindex]
REGEX = (?i) error
DESTKEY = MetaData:Index
WRITEMETA = true
FORMAT = metrics_index

[changesourcetype]
REGEX = (?i) error
DESTKEY = MetaData:
WRITEMETA = true
DESTKEY = MetaData:Sourcetype
FORMAT = sourcetype::metricssourcetype

[DavidHourani]

Hi @imrago,

the sourcetype csv already has a lot of predefined configurations that are probably overwritting whatever you are trying to do there. Change a your sourcetype's name and you should be okay 😉

Cheers,
David

[somesoni2]

What are the fields available in your CSV file?? See this Splunk documentation for what format Splunk expects it: https://docs.splunk.com/Documentation/Splunk/7.2.6/Metrics/GetMetricsInOther

[imrago]

used csv just an example, when I send directly to a metrics index then everything is working fine