Splunk Cloud Platform

Use Ingest Processors

Send metrics data from Ingest Processor to a Splunk platform metrics index

Send your data from Ingest Processor to a Splunk platform metrics index. First generate logs to metrics, and add a Splunk metrics store destination in the Ingest Processor service. Depending on the environment that your Ingest Processor is installed in, you can configure the destination to use different authentication methods to access your bucket: You can then create a pipeline that uses that destination. When you apply that pipeline to your Ingest Processor, the Ingest Processor starts sending data that it receives to a Splunk platform metrics index. Selecting Splunk metrics index as a destination involves selecting a metrics destination and a corresponding metrics index.

Prerequisites

Create metrics index

You can create metrics indexes with Splunk Web, the CLI, the REST API, or by editing the indexes.conf file directly. For more about metrics, see Overview of metrics in the Metrics manual.

Create a metrics index in Splunk Web

  1. In Splunk Web, navigate to Settings, then Indexes, and click New.
  2. For Index Name, type a name for the index. User-defined index names must consist of only numbers, lowercase letters, underscores, and hyphens. Index names cannot begin with an underscore or hyphen, or contain the word "kvstore".
  3. For Index Data Type, click Metrics.
  4. (Optional) Set Timestamp Resolution to Milliseconds if you want the metrics index to store metric data points at that increased level of granularity. Metrics indexes with millisecond timestamp resolution have decreased search performance. For more information, see Metrics indexes with millisecond timestamps in the Create custom indexes topic in the Managing Indexers and Clusters of Indexers manual.
  5. Enter the remaining properties of the index as needed. For details, see Create events indexes.
  6. Click Save.

On the Select a metrics destination page, select the name of the metrics index destination that you want to send your metrics to.

Steps

The following steps must be completed in order to send metrics data from Ingest Processor to a Splunk metrics index.

  1. Create a pipeline.
  2. On the pipeline wizard, On the Select a metrics destination page, select the name of the metrics index destination that you want to send your metrics to.
  3. Specify the target indexer.
  4. On the pipeline editor/SPL2 editor experience, configure the actions to convert logs to metrics. For more information, see the Generate logs into metrics topic in this manual.
  5. Review and accept the model message saying you saved pipeline to route metrics to Splunk metrics index. Click Save to proceed.
  6. Save and apply your pipeline.

See also

Last modified on 10 September, 2024
Send data from Ingest Processor to your Splunk Observability Cloud deployment   Send data from Ingest Processor to Amazon S3

This documentation applies to the following versions of Splunk Cloud Platform: 9.1.2308, 9.1.2312, 9.2.2403, 9.2.2406 (latest FedRAMP release)


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters