Splunk® Enterprise

Metrics

Splunk Enterprise version 7.3 is no longer supported as of October 22, 2021. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk® Enterprise. For documentation on the most recent version, go to the latest release.

Create and edit metric rollup policies with Splunk Web

This topic shows you how to create or edit a metric rollup policy with Splunk Web.

Create a new metric rollup policy for a metric index

Prerequisites

Steps

  1. Select Settings > Indexes to open the Indexes listing page.
  2. Find a metrics index that you want to define a metric rollup policy for and click its Edit link. Metrics indexes that do not have rollup policies have an icon that looks like a measuring stick: This icon looks like a small measuring stick.
  3. Scroll down to the bottom of the Edit dialog. Under Rollup Policy, click Create a new policy.
  4. Define a rollup summary. Select a target index and a time range.
    Setting Description
    Target index This is the metric index that the rollup summary will be stored on. The drop-down displays only metric indexes.
    Time range This setting provides the period of the search that populates the rollup summary with aggregated metric data points.
  5. (Optional) Click Add another summary to add an additional rollup summary.
  6. (Optional) Define a dimension filter.
    Select either Included Dimensions or Excluded Dimensions. Then click in the dimension field to select one or more dimensions. The dimension list is limited to dimensions that were indexed by the source index in the past 24 hours.
    Setting Description
    Included Dimensions Select to indicate that the listed dimensions are the only dimensions from the source metric that should be in the rollup metric produced by the metric rollup policy. In addition, metrics in the source index that do not have these dimensions will not be rolled up.
    Excluded Dimensions Select to indicate that the rollup metrics produced by the metric rollup policy will have of the dimensions in the source metrics except for the listed dimensions. Source metrics that only have some combination of the excluded dimensions will not be rolled up.
  7. (Optional) Click Add exception rule to define an exception rule.
    An exception rule enables you to override the default aggregation function for a specific metric. Metric rollup policies can have multiple exception rules.
    Setting Description
    Exception Metric Select a metric that needs a different aggregation function from the default. The list displays only metrics that have been indexed by the source index within the past 24 hours.
    Aggregation Select an alternate aggregation function for the metric.
  8. (Optional) Click General Policy to return to the general policy settings.
  9. Click Create policy to save your new policy.
    If you are editing your policy, click Edit policy to save your changes.

On the Indexes listing page, metrics that have a metric rollup policy have an icon that looks two square plates being pushed together, as if to compress something between them: Rolled up metrics index icon.png

Change the default aggregation

When you create metric rollup policies through Splunk Web, they have avg as their default aggregation function. The summary-creating search applies this default aggregation function to the metrics it finds in the source metric index, save those metrics that have exception rules defined for them.

You cannot change this default aggregation function through the UI, but you can change it for specific metric rollup policies if you have access to metric_rollups.conf. See Manage metric rollup policies through configuration files.

Last modified on 17 July, 2019
Roll up metrics data for faster search performance and increased storage capacity   Manage metric rollup policies with configuration files

This documentation applies to the following versions of Splunk® Enterprise: 7.3.0


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters