...
[qmStats_json]
DATETIME_CONFIG =
INDEXED_EXTRACTIONS = json
KV_MODE = none
NO_BINARY_CHECK = true
TIMESTAMP_FIELDS = attributes.endDate,attributes.endTime
TIME_FORMAT = %Y-%m-%d %H.%M.%S
TZ = Australia/ACT
category = Structured
description = Queuemetrix Stats, JavaScript Object Notation format. For more information, visit http://json.org/
disabled = false
pulldown_type = true
[qmTrace_json]
DATETIME_CONFIG =
INDEXED_EXTRACTIONS = json
KV_MODE = none
NO_BINARY_CHECK = true
TIMESTAMP_FIELDS = attributes.endDate,attributes.endTime
TIME_FORMAT = %Y-%m-%d %H:%M:%S
TZ = Australia/ACT
category = Structured
description = Queuemetrix Activity Trace, JavaScript Object Notation format. For more information, visit http://json.org/
disabled = false
pulldown_type = true
[qmStatus_json]
DATETIME_CONFIG =
INDEXED_EXTRACTIONS = json
KV_MODE = none
NO_BINARY_CHECK = true
TIMESTAMP_FIELDS = createDate
TIME_FORMAT = %d/%m/%Y %OI:%M:%S %p
TZ = Australia/Sydney
category = Structured
description = Queuemetrix Status, JavaScript Object Notation format. For more information, visit http://json.org/
disabled = false
pulldown_type = true
[qmEvents_json]
DATETIME_CONFIG =
INDEXED_EXTRACTIONS = json
KV_MODE = none
NO_BINARY_CHECK = true
TIMESTAMP_FIELDS = createDate
TIME_FORMAT = %b %d, %Y %OI:%M:%S %p
category = Structured
description = Queuemetrix Events, JavaScript Object Notation format. For more information, visit http://json.org/
disabled = false
pulldown_type = true[qmResetQStats_json]
INDEXED_EXTRACTIONS = json
KV_MODE = none
NO_BINARY_CHECK = true
TIMESTAMP_FIELDS = createDate
TIME_FORMAT = %d/%m/%Y %OI:%M:%S %p
TZ = Australia/Sydney
category = Structured
description = Queuemetrix ResetQStats, JavaScript Object Notation format. For more information, visit http://json.org/
disabled = false
pulldown_type = true
Log File Data Formats
Please refer to APENDIX B – LOGGING DATA PROCESSOR for more information.
Include Page | ||||
---|---|---|---|---|
|
Using SPLUNK
Once you have added the Lamaxu logs data to SPLUNK the MQ metrics can be queried using SPLUNK search syntax.