We have updated our Terms of Service, Code of Conduct, and Addendum.

Cribl Internal Metrics - sourcetype.in

dvansh Posts: 6


We have turned on the cribl internal metrics source and are receiving all the metrics data in Splunk via HEC. The only metric we are not receiving is cribl.logstream.sourcetype.in_bytes. We are receiving out_bytes.

Does anyone know the reason for this?

Thank you


  • Kyle McCririe
    Kyle McCririe Posts: 26 mod

    Are you setting the Sourcetype in a Pipeline? If the data does not have a Sourcetype as its coming into Stream we cannot get the sourcetype.in_bytes.

  • dvansh
    dvansh Posts: 6

    Hello, we are setting the sourcetype in the source configuration:

    Source → Configure → Processing Settings → Fields

    Should we move it to the pipeline instead?

    Thank you