Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Splunk metric names should be validated via regex #34275

Closed
spiffyy99 opened this issue Jul 26, 2024 · 4 comments
Closed

Splunk metric names should be validated via regex #34275

spiffyy99 opened this issue Jul 26, 2024 · 4 comments
Assignees
@spiffyy99
Labels
internal/splunk needs triage New item requiring triage

Comments

@spiffyy99
Copy link
Contributor

Component(s)

internal/splunk

Describe the issue you're reporting

Currently, while parsing splunk metric fields from events (starting with metric_name), no validation is done to ensure the metric names actually fit with Splunk criteria. According to the Splunk documentation, metric names have the following restriction:

Metric names can include only upper-case letters, lower-case letters, numbers, underscores, dots, and colon symbols.
Metric names cannot include spaces or the reserved term metric_name. Metric names cannot begin with numbers or underscores.

It follows that field names that don't follow this convention should be designated as dimensions rather than metric datapoints.
@spiffyy99 spiffyy99 added the needs triage New item requiring triage label Jul 26, 2024
@github-actions GitHub Actions
Copy link
Contributor

Pinging code owners:

See Adding Labels via Comments if you do not have permissions to add labels yourself.

@spiffyy99 spiffyy99 mentioned this issue Jul 29, 2024
Merged
@github-actions github-actions bot mentioned this issue Jul 30, 2024
Closed
dmitryax added a commit that referenced this issue Jul 30, 2024
@spiffyy99 @dmitryax
[internal/splunk] Splunk metric names should be validated via regex (#…
f01613a 
…34291)

**Description:** For the splunk HEC receiver, add additional criteria
for the metric names. As per
https://docs.splunk.com/Documentation/Splunk/9.2.1/Metrics/Overview#What_is_a_metric_data_point.3F,
metric names can only consist of specific characters. Validates these
requirements to be in line with other Splunk receivers.

**Link to tracking Issue:**
[#34275](#34275)

---------

Co-authored-by: Dmitrii Anoshin <anoshindx@gmail.com>
@crobert-1
Copy link
Member

Hello @spiffyy99, thanks for filing! Since #34291 has been merged, can we close this issue?

@spiffyy99
Copy link
Contributor Author

yes, i'll close it now. thanks for the review.

@crobert-1
Copy link
Member

Thanks for resolving, really appreciate the help!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@spiffyy99 spiffyy99

Labels
internal/splunk needs triage New item requiring triage
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@spiffyy99 @crobert-1