You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
134 lines
3.9 KiB
134 lines
3.9 KiB
|
|
###
|
|
# redirects data into into the _metrics index
|
|
###
|
|
[metrics_index_redirect]
|
|
REGEX = .
|
|
DEST_KEY = _MetaData:Index
|
|
FORMAT = _metrics
|
|
|
|
|
|
###
|
|
# sets the metric_name 'prefix' for this event. The
|
|
# metric schema processor will append the actual measure names to
|
|
# this prefix for the final metric_name for the event
|
|
###
|
|
[metrics_log_metric_name]
|
|
INGEST_EVAL = metric_name="spl.mlog.".case(\
|
|
group IN ( "subtask_seconds",\
|
|
"subtask_counts",\
|
|
"search_concurrency",\
|
|
"deploy-server",\
|
|
"thruput",\
|
|
"jobs",\
|
|
"search_health_metrics",\
|
|
"tailingprocessor" ) AND isnotnull(name),\
|
|
group.".".name,\
|
|
group == "pipeline" AND name == "indexerpipe" AND processor == "indexer",\
|
|
group.".".processor,\
|
|
group == "dutycycle" AND name == "misc",\
|
|
group.".".name,\
|
|
group == "search_concurrency" AND isnotnull(user),\
|
|
group.".per_user",\
|
|
group == "bundles_downloads" AND isnotnull(baseline_count),\
|
|
group.".baseline",\
|
|
group == "bundles_downloads" AND isnotnull(delta_count),\
|
|
group.".delta",\
|
|
isnotnull(group), group,\
|
|
1 == 1, "nullgroup"\
|
|
)
|
|
|
|
###
|
|
# This transforms simply clones the event as is, updates it's sourcetype
|
|
# to metrics_log. This event will then undergo the transforms associated
|
|
# with the metrics_log sourcetype
|
|
###
|
|
[metrics_log_clone]
|
|
SOURCE_KEY = MetaData:Source
|
|
REGEX = (.)
|
|
CLONE_SOURCETYPE = splunk_metrics_log
|
|
|
|
###
|
|
# This metric schema stanza will define a schema to convert the metrics.log
|
|
# event into a metric data point.
|
|
###
|
|
[metric-schema:metrics_dot_log]
|
|
METRIC-SCHEMA-MEASURES = _NUMS_EXCEPT_ destPort,sourcePort
|
|
|
|
|
|
###
|
|
# start transforms for introspection logs
|
|
#
|
|
# Follows similar pattern to metric.log case above. We clone
|
|
# the events, create a metric_name prefix and send them through
|
|
# our metric schema processor to form them into valid
|
|
# metric store event.
|
|
###
|
|
[introspection_disk_objects_log_clone]
|
|
SOURCE_KEY = MetaData:Source
|
|
REGEX = (.)
|
|
CLONE_SOURCETYPE = splunk_intro_disk_objects
|
|
|
|
[introspection_resource_usage_log_clone]
|
|
SOURCE_KEY = MetaData:Source
|
|
REGEX = (.)
|
|
CLONE_SOURCETYPE = splunk_intro_resource_usage
|
|
|
|
|
|
###
|
|
# sets the metric_name prefix for this introspection
|
|
# events
|
|
###
|
|
[introspection_disk_objects_metric_name]
|
|
INGEST_EVAL = metric_name = "spl.intr.disk_objects"\
|
|
.case(\
|
|
isnotnull( component ), ".".component\
|
|
, 1==1, ""\
|
|
)
|
|
|
|
[introspection_resource_usage_metric_name]
|
|
INGEST_EVAL = metric_name = "spl.intr.resource_usage"\
|
|
.case(\
|
|
isnotnull( component ), ".".component,\
|
|
1==1, ""\
|
|
)
|
|
|
|
#
|
|
# NOTE: we choose to blacklist max_size, which is reported as
|
|
# part of the Volumes component, to be a dimension since it
|
|
# can take on the value: "Infinite" AND it is wasteful to
|
|
# store it as a measure as it won't change a lot anyways
|
|
###
|
|
[metric-schema:introspection_disk_objects]
|
|
METRIC-SCHEMA-MEASURES = _NUMS_EXCEPT_ *data.top_*
|
|
METRIC-SCHEMA-BLACKLIST-DIMS = datetime, *data.top_*, *data.args
|
|
|
|
|
|
|
|
#
|
|
# NOTE: we choose to blacklist 'interval' since this will
|
|
# mostly be a fixed value, no need to take up space for it
|
|
# as a measure
|
|
#
|
|
# 'datetime' is blacklisted as a dimension since it is
|
|
# high cardinality and redundant w/ _time field
|
|
###
|
|
[metric-schema:introspection_resource_usage]
|
|
METRIC-SCHEMA-MEASURES = _NUMS_EXCEPT_ *data.splunk_version, *data.pid, *data.ppid, *data.interval
|
|
METRIC-SCHEMA-BLACKLIST-DIMS = datetime
|
|
|
|
[metric-schema:log2metrics_default_csv]
|
|
METRIC-SCHEMA-MEASURES = _ALLNUMS_
|
|
[metric-schema:log2metrics_default_keyvalue]
|
|
METRIC-SCHEMA-MEASURES = _ALLNUMS_
|
|
[metric-schema:log2metrics_default_json]
|
|
METRIC-SCHEMA-MEASURES = _ALLNUMS_
|
|
|
|
[metrics_field_extraction]
|
|
# Ensure that "-" character is last in the value character class
|
|
# so it is not incorrectly interpreted as a range.
|
|
REGEX = ([a-zA-Z0-9_\.]+)=\"?([a-zA-Z0-9_\.:-]+)
|
|
FORMAT = $1::$2
|
|
REPEAT_MATCH = true
|
|
WRITE_META = true
|