We have updated our Terms of Service, Code of Conduct, and Addendum.

Cribl Internal Metrics

dvansh
dvansh Posts: 6 ✭
in Stream

Hello,

We are trying to enable the cribl metrics to send to Splunk. We are specifically looking for the following metrics:

cribl.logstream.host.(in_bytes,in_events,out_bytes,out_events)
cribl.logstream.index.(in_bytes,in_events,out_bytes,out_events)
cribl.logstream.source.(in_bytes,in_events,out_bytes,out_events)
cribl.logstream.sourcetype.(in_bytes,in_events,out_bytes,out_events)

The source has been configured with Full Fidelity set to Yes. In the settings under limits, we have removed all the values in Disable Field Metrics on both the leader and worker nodes. We have restarted all the services.

The data is still not visible in the Sources → Live Data view.
Have we missed a step?

Thank you

Answers

  • Jon Rust
    Jon Rust Posts: 475 mod

    Which stage did you select in the capture? What was your capture filter? Did you commit and deploy?

  • dvansh
    dvansh Posts: 6 ✭

    The stage was:

    1. Before pre-processing Pipeline

    The filter is true and we did commit and deploy.

    We are capturing from the source object.

  • Jon Rust
    Jon Rust Posts: 475 mod
    edited July 2023

    Im not clear on 2 things:

    1. What do you mean "In the settings under limits, we have removed all the values in Disable Field Metrics on both the leader and worker nodes"? I dont see a limits option in the Cribl Internal source for metrics. And I dont follow "on both the leader and worker nodes"

    2. Captured from the source object? I dont follow. To get on the same page, try going to Sources → Cribl Internal. The CriblMetrics entry should be enabled. If not, please do so, and commit & deploy. If it is, click the green live button the right side of the screen.

    488acc0d3ed9158bd90b61fc88237def6c94c198.png

Categories