My splunk server is receiving metrics from collectd.
I want to build a table showing the metrics, dimensions, and values emitted for each unique metric_name/dimension/host combination.
| metirc_name | dimension_1 | ... | dimension_n | avg_value over 10s | <- it would look something like that
Ideally what I'm asking for is something like this:
| mstats WHERE source=*, metric_name=*, index=* BY * | table *
I want the value for each unique combination of metric_name and dimension and value for a given. But wildcards are not allowed in the BY clause.
I need to fill in empty dimensions because not all values will have the same dimensions.
I don't see a way to query with out explicitly defining each dimension key. Additionally I don't see a way to extract the raw datapoints from splunk. I could settle for averaging over a time span for the unique combination of host, metric_name, and all dimensions.
Any help is greatly appreciated!
... View more