Cribl Metric from Windows Pack

brandonf

Hi Everyone

I am have a strange problem with metric feed from a route that uses the Windows Pack. I currently forward ALL my Cribl metrics via Quickconnect to Splunk and simply add a index and sourcetype field (no other changes).

When run my mstats search on cribl.logstream.route.in_bytes and cribl.logstream.route.out_bytes and split by the route name. The only metric i dont seem to see if the route that uses the Windows pack? I have tested a couple other packs like fortigate and that works. I do however see metrics using cribl.logstream.sourcetype.in_bytes and cribl.logstream.sourcetype.out_bytes when I use event_sourcetype? Find this a bit bizarre?

Thanks

Melori Arellano

Hi Brandon! Which Windows Pack are you using?

Have you tried running a capture on the Windows pack route in question to see what the output looks like? It will automatically apply the filter for that route and might give some insight into which events are passing through (or being filtered out).

You can also create a sample file to preview how each route in the pack affects your output data.