Advanced methods for getting data in to Splunk IAI

If none of the methods described in Get your metrics and alarms data in to Splunk IAI work for your industrial data, you may need to use advanced methods for getting your data in.

You must be or have access to a Splunk Enterprise administrator who has experience managing Splunk configuration files to use advanced methods for getting data in. If you are new to working with configuration files, contact Splunk Professional Services for assistance setting up your data ingestion.

If you ingested data into a Splunk Enterprise events index and you need to extract metrics from those events to use in Splunk IAI, you can convert your event data into metrics data points that fit the requirements of the IoT common information model. Write a search using the mcollect search command to extract metrics data points, along with their required dimensions for IAI, from event data. See mcollect in the Splunk Enterprise Search Reference for syntax and usage details.

If your raw data contains multivalued metrics in key-value pairs, CSV, or JSON format, you can create a custom source type to extract that data into individual metric data points when you ingest the data into the Splunk platform so that it fits the requirements of the IoT common information model. Work with Splunk professional services to create the source types in the configuration files to support your raw metrics data.

For more about the IoT common information model, see Data format requirements for Splunk IAI .