metric event is not properly structured issue in my SH !

[AL3Z]

Hi
I'm seeing an error message in my es search head, How we can sort out this issue Search peer idx-xxx.com has the following message: The metric event is not properly structured, source=nmon_perfdata_metrics, sourcetype=nmon_metrics_csv, host=xyz, index=unix-metrics. Metric event data without a metric name and properly formated numerical values are invalid and cannot be indexed. Ensure the input metric data is not malformed, have one or more keys of the form "metric_name:<metric>" (e.g..."metric_name:cpu.idle") with corresponding floating point values.

Thanks

[richgalloway]

The error message seems plain enough.  There is data going into a metrics index that is not formatted properly for that index type.  Either correct the event format or send the data to an events index.

[AL3Z]

@richgalloway 
I'm working on Splunk cloud how we can correct the event format or send the data to an events index ?

[richgalloway]

Onboarding of data is completely under your control even in Splunk Cloud.  To send the data to an events index, change the index name in inputs.conf to one that is for events.

Note that there are two types of indexes: event indexes and metrics indexes.  Events indexes are the traditional type and can hold any text data.  Metrics indexes are relatively new and are designed to hold metrics data in a specific format for faster processing.  A metrics index cannot store events nor can it store data that is not properly formatted.

Changing the format of the data depends on the source of that data.  You may have to work with the data engineer to get the data formatted such that it can be stored in a metrics index.