Skip to main content

Hello,

We are trying to enable the cribl metrics to send to Splunk. We are specifically looking for the following metrics:

cribl.logstream.host.(in_bytes,in_events,out_bytes,out_events)cribl.logstream.index.(in_bytes,in_events,out_bytes,out_events)cribl.logstream.source.(in_bytes,in_events,out_bytes,out_events)cribl.logstream.sourcetype.(in_bytes,in_events,out_bytes,out_events)

The source has been configured with Full Fidelity set to Yes. In the settings under limits, we have removed all the values in Disable Field Metrics on both the leader and worker nodes. We have restarted all the services.

The data is still not visible in the Sources → Live Data view.
Have we missed a step?

Thank you

Which stage did you select in the capture? What was your capture filter? Did you commit and deploy?

The stage was:

  1. Before pre-processing Pipeline

The filter is true and we did commit and deploy.

We are capturing from the source object.

Im not clear on 2 things:

  1. What do you mean "In the settings under limits, we have removed all the values in Disable Field Metrics on both the leader and worker nodes"? I dont see a limits option in the Cribl Internal source for metrics. And I dont follow "on both the leader and worker nodes"

  2. Captured from the source object? I dont follow. To get on the same page, try going to Sources → Cribl Internal. The CriblMetrics entry should be enabled. If not, please do so, and commit & deploy. If it is, click the green live button the right side of the screen.

130_afa690e161dc493a9c720fbd2634d932.png

Reply


Terms & ConditionsCookie settings