I have tested the query and can confirm that some metrics are being processed, as I mentioned in my initial question. For example: 04-02-2025 08:17:01.787 +0000 INFO Metrics - group=per_source...
See more...
I have tested the query and can confirm that some metrics are being processed, as I mentioned in my initial question. For example: 04-02-2025 08:17:01.787 +0000 INFO Metrics - group=per_source_thruput, ingest_pipe=1, series="/opt/splunk/var/log/splunk/splunk_ta_microsoft-cloudservices_azure_resource.log", kbps="1.382", eps="3.766", kb="41.450", ev=113, avg_age="2.867", max_age=4 However, I still don’t see any logs related to Load Balancers. Regarding your question: Yes, the index for this metric input is a metric index, not an event index. That said, I have downloaded the source code of the add-on and I suspect the issue might be on the Azure side. Here’s why: I debugged the execution flow: _index_resource_metrics: This function prepares the request. Here, I do see references to the Load Balancer. _index_metrics: This function calls _fetch_resource_metrics, which sends the request to Azure and processes the results in a loop. If the response is empty, there is no log message indicating that Azure returned no data. No relevant errors or exceptions were found in the logs.