Claude
Skills
Sign in
Back

splunk-metrics

Included with Lifetime
$97 forever

# splunk-metrics

General

What this skill does

# splunk-metrics

Real-time metrics and data point analysis for Splunk.

## Purpose

Query and analyze metrics data using mstats and mcatalog commands.

## Risk Levels

| Operation | Risk | Notes |
|-----------|------|-------|
| List metrics | - | Read-only |
| List metric indexes | - | Read-only |
| Query with mstats | - | Read-only |
| Discover with mcatalog | - | Read-only |

## Triggers

- "metrics", "mstats", "mcatalog"
- "time series", "data points"

## CLI Commands

| Command | Description |
|---------|-------------|
| `metrics mstats` | Execute mstats command |
| `metrics mcatalog` | Query metrics catalog |
| `metrics mpreview` | Preview metrics data |
| `metrics indexes` | List metric indexes |
| `metrics list` | List metric names |

## Options

| Option | Commands | Description |
|--------|----------|-------------|
| `-i`, `--index` | mstats, mcatalog, mpreview, list | Metrics index |
| `-o`, `--output` | mcatalog, mpreview | Output format (text, json) |
| `-m`, `--metric` | mcatalog | Filter by metric name pattern |
| `-f`, `--filter` | mpreview | Filter expression (e.g., host=server1) |
| `-c`, `--count` | mpreview | Number of data points |
| `--agg` | mstats | Aggregation function |
| `--split-by` | mstats | Split by field |
| `--span` | mstats | Time span |

## Examples

```bash
# List metrics
splunk-as metrics list -i metrics

# List metric indexes
splunk-as metrics indexes

# Query with mstats
splunk-as metrics mstats cpu.percent --agg avg --split-by host --span 1h

# Discover metrics with mcatalog (use -m/--metric for filtering)
splunk-as metrics mcatalog -i metrics -m "cpu.*"
splunk-as metrics mcatalog -i metrics -o json

# Preview metrics data (requires metric_name positional arg)
splunk-as metrics mpreview cpu.percent -i metrics
splunk-as metrics mpreview cpu.percent -i metrics -f "host=server1" -c 50
```

## SPL Patterns

```spl
| mstats avg(cpu.percent) WHERE index=metrics BY host span=1h
| mcatalog values(metric_name) WHERE index=metrics
| mpreview index=metrics
```

Related in General