About thaggie_splunk

kulick · ‎01-15-2025

I know this is a while ago now, but maybe helpful to others...try using the "hidden" dimension `_timeseries`. This is a JSON string that is an amalgamation of all of the dimensions for each datapoint. Take care, the results may be (very) high arity and splunkd doesn't (yet?) have very strong protections for itself (in terms of RAM used while searching) when using this code path, so it is (IMHO) easy to crush your indexer tier's memory and cause lots of thrashing.

peiffer · ‎03-24-2024

Have there been any updates on methodologies for extacting multiple metrics in a single mstats call? I can do the work with a join across _time and dimensions held in common, but after about 2 metrics, the method gets a bit tedious.

thaggie_splunk · ‎04-10-2019

That's right

deodion · ‎03-27-2019

Hello thaggie, thanks for replying, the problem with this is simply that I didnt setup the index type correctly, the index type should be metric.

inventsekar · ‎12-16-2018

Good learning about "metrics" feature. thanks for sharing.

thaggie_splunk · ‎05-30-2018

Hi Lorenz, We didn't want to return metrics indexes by default as people with existing code would suddenly start to get indexes that needed to be queried in a different way. In the link you gave the first parameter listed for GET /data/indexes is "datatype", this can be "all", "event" or "metric" - "event" is the default. So to list all indexes: | rest /services/data/indexes datatype=all

Posts	13
Solutions	4
Karma Given	2
Karma Received	16
Member Since	‎11-08-2016

Online Status	Offline
Date Last Visited	‎06-22-2021 01:34 PM

Re: How would I build a table of all metrics and t...

Re: Using mstats to create separate columns per me...

Re: Metrics Index - How to get metric_searchtime f...

Re: mstats and mcatalog simply does not work

Re: How do you search metrics? (contradictory docu...

Re: Metrics indexes missing in REST-API listing?

Join the Conversation