We have updated our Terms of Service, Code of Conduct, and Addendum.

Cribl Internal Metrics - sourcetype.in

dvansh
dvansh Posts: 6 ✭
in Stream

Hello,

We have turned on the cribl internal metrics source and are receiving all the metrics data in Splunk via HEC. The only metric we are not receiving is cribl.logstream.sourcetype.in_bytes. We are receiving out_bytes.

Does anyone know the reason for this?

Thank you

Answers

  • Kyle McCririe
    Kyle McCririe Posts: 29 ✭✭

    Are you setting the Sourcetype in a Pipeline? If the data does not have a Sourcetype as its coming into Stream we cannot get the sourcetype.in_bytes.

  • dvansh
    dvansh Posts: 6 ✭

    Hello, we are setting the sourcetype in the source configuration:

    Source → Configure → Processing Settings → Fields

    Should we move it to the pipeline instead?

    Thank you

Categories