Splunk® Enterprise

Metrics

Download manual as PDF

Download topic as PDF

Manage metric rollup policies with configuration files

If you have access to the configuration files for your deployment, you can manually configure metric rollup policies for your source metric indexes. This method gives you a small amount of extra flexibility that you do not have when designing rollup policies with Splunk Web: You can define a default aggregation function for the metric rollup policy that is not <avg>.

See Roll up metrics data for faster search performance and increased storage capacity for a conceptual overview of metric rollup policies.

You should have already identified or created a source metric index and one or more target metric indexes before you create a metric rollup policy configuration. These indexes must be discoverable on the search head. If you use distributed search you have to create stand-in indexes and set up data forwarding to enable metric rollup policies.

See Index prerequisites for metric rollup policies.

Metric rollup feature extensions that are not available in Splunk Web

When you manage metric rollup policies through direct edits to configuration files, you can take advantage of optional feature extensions that are not yet available in Splunk Web.

Extended feature In Splunk Web Through configuration file edits Setting
Change the default aggregation function The default aggregation function for a new rollup policy is fixed to avg. There is no way to change this in Splunk Web. You can change the default aggregation function to one or more aggregation functions. The search head rolls up aggregated metrics for each function you specify. defaultAggregation
Metric filtering You cannot design a rollup policy that filters specific metrics out of the resulting rollup summaries. You can identify a set of metrics that are specfically included in or excluded from the summaries generated by the rollup policy. metricList and metricListType
Multiple aggregation functions for metric exclusion rules You can only specify one alternate aggregation function for a metric. You can define exclusion rules that specify two or more alternate aggregation functions for a metric. aggregation.<metric_name>

You can also manage this extended functionality through REST API operations on the metric rollup endpoints. See Metrics Catalog endpoint descriptions in the REST API Reference Manual.

Specify a metric rollup policy stanza in metric_rollups.conf

To configure a metric rollup policy you need to add a stanza to your metric_rollups.conf file.

The configuration syntax for a metric rollup policy stanza is as follows:

[index:<Metric Index Name>]
defaultAggregation = <'#' separated list of aggregation functions>
rollup.<summary number>.rollupIndex = <string Index name>
rollup.<summary number>.span = <time range string>
metricList = <comma-separated list of metrics>
metricListType = <excluded/included>
dimensionList = <comma-separated list of dimensions>
dimensionListType = <excluded/included>
aggregation.<metric_name> = <'#' separated list of aggregation functions>

The following table defines these settings. It explains which settings are required and which are optional.

Setting Value Required? Description Default Value
[index:<Metric Index Name>] A name of a source metric index. Yes This is the stanza header. It names the source metric index to which the metric rollup policy belongs. n/a
defaultAggregation A list of aggregation functions, separated by # characters. Yes This setting provides the set of aggregation functions that the rollup search uses when it aggregates the metric data points in the source metric index for a rollup summary. The defaultAggregation can be overruled for specific metrics by the aggregation.<metric_name> setting. This setting supports the following functions: avg, count, max, median, min, perc<int>, and sum. avg
rollup.<summary number>.rollupIndex The name of the target index for the rollup. Yes This setting is one half of a rollup summary definition. Both halves of a rollup summary definition should have the same <summary number>. To be valid, a metric rollup policy stanza must include at least one full rollup summary definition. The <string Index name> is the name of the target metric index where the summary is stored. This setting is required. Do not leave it blank. summary number = 1, string index name = Metric Index Name from header
rollup.<summary number>.span A time range string. Yes This setting is one half of a rollup summary definition. Both halves of a rollup summary definition should have the same <summary number>. A metric rollup policy can have multiple rollup summary definitions. To be valid, a metric rollup policy stanza must include at least one full rollup summary definition. The <time range string> is the period of the scheduled search that populates the rollup summary with rolled up metric data points that are aggregations of metrics in the source index. This setting has a lower boundary that is governed by the minspanallowed setting in limits.conf, which has a default setting of 300 seconds, or five minutes. This setting is required. Do not leave it blank. summary number = 1, time range string = 1h
metricList A comma-separated list of metric names. No Use this setting in conjunction with metricListType to create a filter at the search head that allows certain metrics to be rolled up but not others. All of the listed metrics should have metric data points in the source metric index. Empty string
metricListType [included | excluded] No Use this setting in conjunction with the metricList setting to create a filter at the search head that allows certain metrics to be rolled up but not others. When you set metricListType to excluded, the search head rolls up all available metrics from the source index except the metrics in metricsList. When you set metricListType to included, the search head rolls up only the metrics in metricsList and filters out all other metrics in the source index. excluded
dimensionList A comma-separated list of dimensions. No Use this setting in conjunction with dimensionListType to create a filter at the search head that allows certain dimensions to be rolled up but not others. All of the listed dimensions should appear in metric data points in the source index. Empty string
dimensionListType [included | excluded] No Use this setting in conjunction with the dimensionListsetting to create a filter at the search head that allows certain dimensions to be rolled up but not others. When you set dimensionListType to excluded the rollup metrics produced by the rollup policy include all available dimensions in the source index except the ones in the dimensionList. When you set dimensionListType to included, the rollup metrics produced by the rollup policy filter out all available dimensions except the ones in the dimensionList. excluded
aggregation.<list of aggregation functions> A list of aggregation functions, separated by # characters. No Use this optional setting to provide an exclusion rule for a specific metric_name in the source metric index. An exclusion rule defines a separate set of aggregation functions for the metric_name.

Use it to specify a different set of aggregation functions for that metric_name. A metric rollup policy can have multiple exclusion rules as long as they are each for a different metric_name. Do not set up an exclusion rule that uses the same set of aggregation functions as the defaultAggregation setting. This setting supports the following functions: avg, count, max, median, min, perc<int>, and sum.

Empty string

Change the minimum span allowed for a rollup summarization search

The rollup.<summary number>.span setting has a lower boundary that is determined by the minspanallowed limit for the [rollup] stanza in limits.conf. minspanallowed is set to 300 seconds, or 5 minutes, by default. If you provide a span for a rollup summarization search that is lower than minspanallowed, you will see an error message.

This limit is meant to prevent you from setting up rollup summarization searches with a frequency that would likely lead to search concurrency problems, where scheduled searches fail to run when they should because there are too many searches running at once. However, if you need to change this limit, you can. Do not set minspanallowed to a value lower than 60 seconds.

PREVIOUS
Create and edit metric rollup policies with Splunk Web
  NEXT
Visualize metrics in the Splunk Metrics Workspace

This documentation applies to the following versions of Splunk® Enterprise: 7.3.2, 8.0.0


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters