That's right ... View more

When you execute: | mcatalog values(metric_name) where index=metrics_app_dest_survey Do you get any values back? You can't aggregate time so you need to remove latest(_time), this should work: | mstats sum(bytes) where index=metrics_app_dest_survey by app_name ... View more

I don't think there is a way to get all of the data out of a metrics index like this, what are you trying to achieve (why are you trying to do do this)? If you have just 100 metrics, each with 5 dimensions, each with just 10 values that'd still be a table with 5,000 rows - that's more information than is appropriate to show a user in a table. To list the dimensions and their values you use the mcatalog command: | mcatalog values(_dims) WHERE metric_name=* AND index=* | mcatalog values(your_dim) WHERE metric_name=* AND index=* ... View more

A good way to learn the mstats command is to install the "Metrics Workspace" app https://splunkbase.splunk.com/app/4192/ and see what it does. ... View more

That is correct ... View more

"I could settle for averaging over a time span for the unique combination of host, metric_name, and all dimensions." | mstats avg(_value) where index=* AND metric_name=* earliest=-1h latest=now by host, metric_name ... View more

You should be able to add a region field as you push the measurements to splunk. From: http://docs.splunk.com/Documentation/Splunk/7.0.0/Metrics/GetMetricsInCollectd curl -k https://localhost:8088/services/collector/raw?sourcetype=collectd_http \ -H "Authorization: Splunk <HEC_token>" \ -d '[{"values":[164.9196798931339196],"dstypes":["derive"],"dsnames":["value"],"time":1505356687.894,"interval":10.000,"host":"collectd","plugin":"protocols","plugin_instance":"IpExt","type":"protocol_counter","type_instance":"InOctets"}]' So each message is like: { "values": [164.9196798931339196], "dstypes": ["derive"], "dsnames": ["value"], "time": 1505356687.894, "interval": 10.000, "host": "collectd", "plugin": "protocols", "plugin_instance": "IpExt", "type": "protocol_counter", "type_instance": "InOctets" } You should be able to add: "region": "us-east" ... View more