is there a way to remove the metric event but still send it to splunk not as a metric

Remove __criblMetric field (I think that's the name). That's where the metric data comes from. Does that do what you want ?

How did it turn into a metric event? Was it sent to Stream as such ?

maybe . its causing splunk to not even search it cause i think splunk sees this as a metric even though im trying to push it not to

ya prometheus /write

but alot of these are like data healthcheck up/down

To search for it in splunk it needs to go to a metric index if it's a metric. Remove that field I mentioned and it can go to a regular index and be searched.

__criblMetric right

i tried in the function in pipeline

View it in preview and enable the internal fields to get the exact name. I'm away from keyboard.

ahhh thx

It's plural at the very least.

__criblEventType:event

__criblMetrics:

cool thanks it worked theres no M there anymore for metrics