is there a way to remove the metric event but still send it to splunk not as a metric (if i hover over it says metric event) i was trying to move _value to value and _metric to metric__name
Page 1 / 1
Remove __criblMetric field (I think that's the name). That's where the metric data comes from. Does that do what you want ?
How did it turn into a metric event? Was it sent to Stream as such ?
maybe . its causing splunk to not even search it cause i think splunk sees this as a metric even though im trying to push it not to
ya prometheus /write
but alot of these are like data healthcheck up/down
To search for it in splunk it needs to go to a metric index if it's a metric. Remove that field I mentioned and it can go to a regular index and be searched.
__criblMetric right
i tried in the function in pipeline
View it in preview and enable the internal fields to get the exact name. I'm away from keyboard.
ahhh thx 
It's plural at the very least.
__criblEventType:event
__criblMetrics:
cool thanks it worked theres no M there anymore for metrics
Reply
Login to the community
No account yet? Create an account
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.