Skip to main content
Solved

Cribl JSON Event Conversion To Splunk Metrics For S2S Indexing

  • February 17, 2026
  • 4 replies
  • 0 views
P
This message originated from Cribl Community Slack.
Click here to view the original link.

In cribl, how do i convert a json event into splunk metrics to be sent to the indexer as s2s? 
{ 
   average: 885463040
   count: 2
   maximum: 908546048
   metricName: AverageMemoryWorkingSet
   minimum: 862380032
   region: Central US
   time: 2026-02-11T08:51:00.0000000Z
   timeGrain: PT1M
   total: 1770926080
}

Best answer by David Maislin

The Publish Metrics function does not automatically drop the original _raw field from the event. Its purpose is to extract, format, and output metrics from events, but it leaves the rest of the event—including _raw—intact unless you explicitly configure downstream functions to remove it. If you want to drop _raw after metrics extraction, you need to add a separate function (such as a Eval with Remove Fields function) in your pipeline after Publish Metrics. This is confirmed in the documentation, which describes Publish Metrics as extracting metrics but does not mention field removal, and in the code, which processes metrics and dimensions but does not modify or remove _raw:

4 replies

David Maislin
Publish Metrics function
David Maislin
https://docs.cribl.io/stream/publish-metrics-function/
P
  • phu.nguyen918
  • Author
  • New Participant
  • February 17, 2026
@user Thanks!
David Maislin
  • David Maislin
  • Employee
  • Answer
  • February 17, 2026
The Publish Metrics function does not automatically drop the original _raw field from the event. Its purpose is to extract, format, and output metrics from events, but it leaves the rest of the event—including _raw—intact unless you explicitly configure downstream functions to remove it. If you want to drop _raw after metrics extraction, you need to add a separate function (such as a Eval with Remove Fields function) in your pipeline after Publish Metrics. This is confirmed in the documentation, which describes Publish Metrics as extracting metrics but does not mention field removal, and in the code, which processes metrics and dimensions but does not modify or remove _raw:
Terms & ConditionsAccessibility statement