0
I'm using the AWS CLI to get some Kinesis metrics - part of that I'm able to specify the output format as one of the below: https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-configure.html#cli-quick-configuration-for...
I've tried TEXT as that seems the most reasonable for splunk but I think the line separated data is messing up splunks ingest:
METRICDATARESULTS iteratorAgeMilliseconds itagemillis PartialData
METRICDATARESULTS readProvisionedThroughputExceeded itagemillis PartialData
TIMESTAMPS 2020-04-15T20:21:00+00:00
TIMESTAMPS 2020-04-15T20:20:00+00:00
TIMESTAMPS 2020-04-15T20:19:00+00:00
TIMESTAMPS 2020-04-15T20:18:00+00:00
TIMESTAMPS 2020-04-15T20:17:00+00:00
TIMESTAMPS 2020-04-15T20:16:00+00:00
VALUES 0.0
VALUES 0.0
VALUES 0.0
VALUES 0.0
VALUES 0.0
VALUES 0.0
METRICDATARESULTS writeProvisionedThroughputExceeded itagemillis PartialData
TIMESTAMPS 2020-04-15T19:36:00+00:00
TIMESTAMPS 2020-04-15T19:35:00+00:00
TIMESTAMPS 2020-04-15T19:34:00+00:00
TIMESTAMPS 2020-04-15T19:33:00+00:00
VALUES 0.0
VALUES 0.0
VALUES 0.0
VALUES 0.0
VALUES 0.0
VALUES 0.0
Any thoughts on either the AWS or splunk side on how best to handle ingesting this data ?
