send metrics to splunk from python

Question

I have a list of dictionaries containing some metrics, let's say

[{"a": 1, "b": 2},
 {"a": 3, "b": 4},
 {"a": 1, "b": 2}]

And as the end result I need to send to splunk two metric messages with

value: 2, dimensions: {"a": 1, "b": 2}  #just amount of elements with same dim values
value: 1, dimensions: {"a": 3, "b": 4}

Is there a way to send them just as original list of dicts so splunk could calculate everything by itself?

Answer 1

You can send all the dimensions as events using HEC, then do the post-processing in splunk. A stats command can come in handy, I've attached an example below. A nice Python class to help sending events to the HTTP Event Collector in your code can be found here: https://github.com/georgestarcher/Splunk-Class-httpevent

Example call:

curl -k "https://localhost:8088/services/collector" \
    -H "Authorization: Splunk hec-token-here" \
    -d '{"event": "{\"a\": 1, \"b\": 2}"}{"event": "{\"a\": 3, \"b\": 4}"}{"event": "{\"a\": 1, \"b\": 2}"}'

Splunk stats

index=main
|stats c by _raw

Notice how the result shows that you have two {"a": 1, "b": 2} events and one {"a": 3, "b": 4} event