Getting Data In

How can I keep an event AND get a metric at index time?

daniel333
Builder

All,

I see a few examples on convert an event received into a metric. Is there a way to say keep an apache log and create a metric of the stratus?

thanks
-Daniel

0 Karma
1 Solution

harsmarvania57
SplunkTrust
SplunkTrust

Hi,

You can convert existing event data into metric using mcollect command so in your case you need to schedule search which will run at regular interval and index data into metric index. Please refer documentation on https://docs.splunk.com/Documentation/Splunk/7.2.6/SearchReference/Mcollect

Using this approach it will keep your apache logs in event index and it will ingest metric data in metric index, only drawback is you'll not able to see real-time data in metric event because it is purely depend on schedule search frequency.

View solution in original post

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Hi,

You can convert existing event data into metric using mcollect command so in your case you need to schedule search which will run at regular interval and index data into metric index. Please refer documentation on https://docs.splunk.com/Documentation/Splunk/7.2.6/SearchReference/Mcollect

Using this approach it will keep your apache logs in event index and it will ingest metric data in metric index, only drawback is you'll not able to see real-time data in metric event because it is purely depend on schedule search frequency.

View solution in original post

0 Karma

daniel333
Builder

Yeah, that might work. I'll talk to the customer to see if a 15 min backfill/delay is acceptable. Thanks for the reply!

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!