is there a way to remove the metric event but still send it to splunk not as a metric (if i hover over it says metric event) i was trying to move _value to value and _metric to metric__name
Remove __criblMetric field (I think that's the name). That's where the metric data comes from. Does that do what you want ?
maybe . its causing splunk to not even search it cause i think splunk sees this as a metric even though im trying to push it not to
How did it turn into a metric event? Was it sent to Stream as such ?
ya prometheus /write
but alot of these are like data healthcheck up/down
To search for it in splunk it needs to go to a metric index if it's a metric. Remove that field I mentioned and it can go to a regular index and be searched.
i tried in the function in pipeline
View it in preview and enable the internal fields to get the exact name. I'm away from keyboard.
It's plural at the very least.
cool thanks it worked theres no M there anymore for metrics