Add-on Builder and Metric Indexes- Why aren't events showing up?

[davidoff96]

Hello,

I have to manipulate some data from an api, and send those events to splunk. One set of the api has to go to a normal index, but a subset of the data has to go to a metrics index, which is defined as an input in the add-on configuration.

However, when I try to send events to the metrics, I don't get anything showing up there. I have tried the following:

• Prepending "metric_name:" to the field name for the metric
• Making a new add-on to only send data to metrics (very simple create an event and send it)
• In that same add-on, create the event, and send it to the index defined in the config, and defined my metrics index in that config

None of these worked. Is there a special way to send these to metrics indexes?

[davidoff96 · Accepted solution]

Alright - the issue was that the sourcetype for the metrics events had to have "INDEXED_EXTRACTIONS=json" in the props.conf. Once I had changed that, I was able to see those values in the metrics index.

[johnhuang]

How are you ingesting the metrics? If you're using HEC, make sure you format it correctly and send it to the correct rest api endpoint url.

https://docs.splunk.com/Documentation/SplunkCloud/9.0.2208/Metrics/GetMetricsInOther 

[davidoff96]

This is through the add-on builder.  When I send the metric through to a normal index, it looks like this:

And my code for generating it looks like this:

data = {
'metric_name:tests_performed:testing': 4
}

event = helper.new_event(source=helper.get_input_type(), index='test-metrics', sourcetype=helper.get_sourcetype(), data=json.dumps(data))
ew.write_event(event)

Where index test-metrics is an index I have set up with the metrics type