Skip to main content
Question

Cribl Internal Metrics - sourcetype.in

  • March 11, 2025
  • 2 replies
  • 12 views
D

Hello,

We have turned on the cribl internal metrics source and are receiving all the metrics data in Splunk via HEC. The only metric we are not receiving is cribl.logstream.sourcetype.in_bytes. We are receiving out_bytes.

Does anyone know the reason for this?

Thank you

    2 replies

    K

    Are you setting the Sourcetype in a Pipeline? If the data does not have a Sourcetype as its coming into Stream we cannot get the sourcetype.in_bytes.

    D
    • dvansh
    • Author
    • New Participant
    • March 11, 2025

    Hello, we are setting the sourcetype in the source configuration:

    Source → Configure → Processing Settings → Fields

    Should we move it to the pipeline instead?

    Thank you

    Terms & ConditionsAccessibility statement