Splunk指标{“文本":“无数据"，“代码":5}错误 [英] Splunk Metrics {"text":"No data","code":5} error

问题描述

我正在尝试通过HEC将指标发送到Splunk，这是我的curl命令:

I'm trying to send metrics to Splunk via HEC, here's my curl command:

curl -k https://www.website.com                    \
-H "Authorization: Splunk password"       \
-d '{"index":"index-name","time": 313423232.000,"event":"metric","source":"disk","sourcetype":"perflog",
"host":"host_1.splunk.com","value":85,"fields":{"region":"us-west-1","datacenter":"dc1","rack":"63",
"os":"Ubuntu16.10","arch":"x64","team":"LON","service":"6","service_version":"0",
"service_environment":"test","path":"/dev/sda1","fstype":"ext3","metric_name:cpu.idle": 13.34}}'

作为回报，我得到:{文本":无数据"，代码":5}

And in return i'm getting: {"text":"No data","code":5}

这很奇怪，因为它可以更早地工作，我所添加的只是"value":85.问题可能是我要发送到的网站吗?

This is weird because it was working earlier, all I added was "value":85. Could the issue be the website i'm sending to?

有些建议的引号不匹配，并且HEC仅支持一组特定的已知字段，但我不认为这是我遇到的问题，因为我尝试仅使用索引，源来运行相同的curl命令，时间，主机，源类型和事件，并具有相同的错误代码.

Some suggestions were mismatched quotes, and the fact that HEC only supports a specific set of known fields, but i don't think that's the issue i'm having here because i tried running the same curl command with only index, source, time, host, sourcetype, and event and got the same error code.

推荐答案

要将指标发送到Splunk HEC，您需要在名为 _value 的字段中包含指标值.您的示例中的最后一个参数也有一些错误.

To send a metric to Splunk HEC, you need to include the metric value in a field called _value. You also had a few errors in the last parameter in your example.

以下请求就足够了.

curl -k https://www.website.com                    \
-H "Authorization: Splunk password"       \
-d '{"index":"index-name","time": 313423232.000,"event":"metric","source":"disk","sourcetype":"perflog",
"host":"host_1.splunk.com","fields":{"region":"us-west-1","datacenter":"dc1","rack":"63",
"os":"Ubuntu16.10","arch":"x64","team":"LON","service":"6","service_version":"0",
"service_environment":"test","path":"/dev/sda1","fstype":"ext3","metric_name": "cpu.idle", "_value": 13.34}}'

这篇关于Splunk指标{“文本":“无数据"，“代码":5}错误的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！