Use the Metric Finder and Metadata Catalog 🔗
The Splunk Infrastructure Monitoring Metric Finder and Metadata Catalog makes it quick and easy to find the metrics you monitor, across infrastructure and over diverse applications and sources. This topic shows you how to leverage the Metric Finder and Metadata Catalog to find, view, and edit information about the metadata in your system.
See the following sections for more information on how to:
Use the Metric Finder 🔗
To open the Metric Finder, hover over Metrics on the navigation bar then select Metric Finder.
You can also find metrics while you build a dashboard or edit a chart. To learn more see Find metrics and events to add to a simple chart.
To learn more about searching for metrics by name, or by related attributes like dimensions, see Search metrics.
To learn about how to browse for metrics, see Browse for metrics.
Browse for metrics 🔗
Select Metrics then Metrics Finder on the navigation bar, the Metric Finder opens with a browsable list of categories, drawn from your Infrastructure Monitoring integrations and custom categories, if configured. Custom categories help you quickly find metrics related to commonly used dimensions in your organization.
If your administrators have not created any custom categories, the custom categories section will not be visible.
If there are no custom categories, Infrastructure Monitoring administrators will see an option to add them. See Manage custom categories.
When you select a custom category value or integration, a key-value pair is added as a search filter, and a metric search is run.
If there are more than a few values for a custom category, you can select Show more to see the first 100 results. If you don’t see the value that you’re looking for in the longer list, you can enter it in the search field to return more relevant search results.
Add metric descriptions 🔗
Descriptions can help users understand what metrics are measuring, especially when the names of metrics are jargon or difficult to recognize. If a metric has a description, it is displayed next to the metric in the search results.
If a metric has a description, you can find it underneathe the metric title. To add a metric description select Add description, or select Edit description to edit the custom description. Some metrics have built-in descriptions (for example, from one of our integrations), this provided description is always shown and is not editable.
Descriptions are lmited to 1,024 characters. Although the descriptions are included in the search result, the text of metric descriptions is not analyzed by the search.
View metric tooltips 🔗
If you hover over a metric name, a tooltip opens that provides information about the metric. Information you can view in the metric tooltip includes the metric name, description, type, the time it was created, and the number of time series that it reports (filtered by any filters that have been applied to your search query).
Search metrics 🔗
You can search for metrics using any information you know about what you’re looking for. This could include the name of the metric, the name of a dimension that’s reported along with it, or the value of a dimension or property that is associated with the metric, in any combination. Select Search metrics or hit Enter to run a search. Each search result is the name of a metric. Search results are URL-addressable; you can link to a set of search results using the URL for that search.
The Metric Finder does not support any special search syntax. Any non-alphanumeric characters in search terms are not included in matches (though these characters can be included in filter values). Advanced search operations like combining search terms with boolean operators, wildcard matching in plain text search terms, or exact matches on multiple search terms are not supported.
On the Metrics page, type search terms into the search field:
Search whatever you know: part of a metric name, the integration that sends it, or a property of the environment it’s reporting from.
Search for metadata (dimensions, properties, and tags) relevant to your target metric.
Paste exact values into the search field. For example, search a hostname to find out what’s reporting from the host.
For example, a plaintext search for
docker cpu prod will return the top 100 metrics that contained
prod in their name or metadata. The metric name or metadata will be highlighted to show which search term it matches. The following illustration shows the matches in one search result.
When you’re typing in the search field, you can type in a dot (.) to see a list of possible completions for the prefix you’ve already typed. Keep typing to refine the list of suggested components. Select a suggested component, or highlight one with the arrow keys and press TAB or Enter to select it.
You can also type in the name of a dimension or property followed by (:), to see a list of possible values for that key in your data. Keep typing to refine the list of suggestions, then choose one to add it as a filter.
Refine your search 🔗
You can refine a search by typing more search terms or by adding filters. You can add filters by selecting facets in the left sidebar, or matching metadata in any of the search results.
You can include wildcards in your filters. For example,
host:test-* filters the results to only those with a value of
host beginning with
You can use (!) (NOT) in your filters to exclude results. For example,
!env:qa filters the results to exclude any metrics with a value of
env equal to
Match metadata 🔗
When a search term that you typed also matches metric metadata (such as a dimension name or a property value), that match will be shown under the metric name with a grey outline. Select the match, or the (+) icon, to add it to your search as a filter. To exclude the metadata from your search results, select the (-) icon.
Increase search results 🔗
If your search did not match any metrics, change the query or remove a filter. Shorter search terms (like
util) are likely to match more results than longer terms (like
utilization). If you don’t see any results using a long search term, try shortening it to a prefix or separating it into a few smaller terms. For example, break
You can also uncheck Active metrics only to include inactive metrics that are no longer actively sending data to Infrastructure Monitoring in your search. (By default, the Metric Finder will only look for metrics that are actively sending data.) If this control is unchecked, the time series count shown when you hover over a metric name will include matching inactive time series as well as active time series.
Open a chart from a metric 🔗
When you have found the metric you want, select the metric name to open the Chart Builder and to start building a new chart with that metric. The new metric plot includes any filters that were part of your search, as well as any matching metadata on the search result that you selected. For more information on using the Chart Builder, see Plot metrics and events using Chart Builder in Splunk Observability Cloud.
To return to search results from the new chart, select either the Close button or the Back button in your browser. If you want to save the chart to a dashboard before exiting, select the Save as button.
Manage custom categories 🔗
Use custom categories to browse for metrics using features that are unique to your organization’s data, like custom tags or properties. If you use custom metrics, you can set up custom categories to surface key dimensions from your data to help your users get started. Custom categories are defined for the entire organization. Only Infrastructure Monitoring users with admin privileges will see a button to Add custom categories.
To select dimensions or properties to be displayed as custom categories on the Metrics page, select Add custom categories. The number of categories for each organization is limited. Once the limit has been reached, the “+” button will be disabled. Select Save and close when you have finished adding categories.
The custom categories you added are now available for use on the Metrics page. Selecting Edit lets you add, delete, or update existing custom categories. Non-administrators do not see the option to edit custom categories.
Use the Metadata Catalog 🔗
Use the metadata catalog to find, view, and edit information about the metadata in your system, such as dimensions, properties, and tags.
Enhancements to Infrastructure Monitoring have changed the function of the Metadata Catalog. The Metadata Catalog previously served many purposes that are now better served by the following features:
Use the Metric Finder to find metrics and related properties. To learn more, see Use the Metric Finder.
Use dashboards to see groupings of charts and visualizations of metrics. To learn more, see Dashboards in Splunk Observability Cloud.
Use navigators to see a data-driven visualization of resources in your environment that are visible to Infrastructure Monitoring. To learn more, see Use navigators in Splunk Infrastructure Monitoring.
Use global search to search all available data.
Search and edit metadata using the Metadata Catalog 🔗
To search for dimensions, properties, or metrics using the Metadata Catalog, perform the following steps:
Enter your search criteria in the Search bar. You can search for metrics, dimensions, custom properties, and tags.
As soon as you enters a search term, the search bar automatically expands a drop-down menu with a matching list of results. The listed values are marked as metric, property, or tag. Both dimensions and custom properties are marked as property.
To search for a metric, enter the metric name you want to search for. For example, enter
cpu.utilization. Observability Cloud displays a chart for the metric, the metric type, and a list of properties (dimensions and custom properties) associated with the metric.
To search for a dimension or a custom property, do one of the following:
Enter a dimension or custom property key. For example, enter
host.name. Observability Cloud displays a list of associated metrics and a list of possible values for the key.
Enter the complete dimension or custom property key-value pair. For example, enter
host.name:appsvr01. Observability Cloud displays all the metrics, metadata (dimensions, properties, and tags), and data links associated with the key-value pair.
To search for a tag, enter the tag you want to search for. For example, enter
kubernetes_service_redis-cart. Observability Cloud displays a list of metrics and properties (dimensions and custom properties) assigned with the tag.
Add or edit metadata. You can add or edit the following metadata:
For a metric:
Metric type: To edit metric type, select Edit next to the Metric Type.
While chart isn’t metadata for a metric, you can also view and edit a chart when searching for a metric using the Metadata Catalog. To edit the chart associated with a metric, select View In Chart and make changes to the chart.
For a dimension or custom property:
Custom property: To add or edit a new custom property, select Edit or Add new property… in the Properties section.
Tag: To add or edit a new tag, select Edit or Add new tag… in the Tags section.
Data links: To add a new data link, select New Link in the Data Links section.
For a tag:
Custom property: To add or edit a new custom property to a tag, select Edit or Add new property… in the Properties section.
For more information on naming custom properties and tags, see Guidance for metric and dimension names.
You can’t add or edit a new dimension to any object after data ingest in Splunk Observability Cloud. To learn more, see When to use each type of metadata.