All Apps and Add-ons

metric roll up naming convention

sistemistiposta
Path Finder

Hello,

I'm trying to roll up a metric index named <name>.
So I added a new index named <name>-rollup and I configured a metric-rollup.conf:

[index:<name>]
defaultAggregation = avg
dimensionList = cluster
dimensionListType = excluded
rollup.0.rollupIndex = <name>_rollup
rollup.0.span = 1d

Ok, it works, but quite useless for me. If I have an app which makes query like

| mstats avg(_value) as value where index= metric_name=system.load1 groupby metric_name, host span=1d
| eval {metric_name}=value

then I have to modify the query as
| mstats avg(_value) as value where index=_rollup metric_name=system.load1_mrollup_avg_86400s groupby metric_name, host span=1d
| eval {metric_name}=value

to work with summarized datas. This is a mess.
Is there a way to at least configure the naming convention of the new metric names?

Because if I can maintain the same metric name in the new index <name>_rollup I still can easily modify all the queries. Otherwise, I have to change all metric names and not only the index name!

Thank you very much
Kind Regards
Marco

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...