HEC Metrics Usage

Reference Link:

• http://www.georgestarcher.com/splunk-metrics-getting-data-in-my-hec-class/

Summary:

You can use this HEC class to send to the Splunk Metric store introduced in Splunk v7.

The key points are:

1. Set the "event" payload field to "metric" in lowercase.
2. Form a JSON dict with the required fields:

• "metric_name" = the string name of your metric measurement field
• "_value" = the numeric measurement value for your field.

3. You can optionally add other fields your JSON dict and those are "dimensions" for the metric.
4. Put your built JSON dict into the payload field "fields".

If you look closely you will realize that you are making a payload for HEC that is ONLY index time data, no raw event data. That is the essence of the Splunk Metrics Store. A special index that holds no raw data for normal searching. Just fast index time data.