Steps for defining a dimension extraction configuration for your StatsD metric data

1. In a text editor, open the transforms.conf configuration file from the local directory for the location you want to use, such as the Search & Reporting app ($SPLUNK_HOME/etc/apps/search/local/) or from the system ($SPLUNK_HOME/etc/system/local).
   If a transforms.conf file does not exist in this location, create a text file and save it to that location.
2. In the transforms.conf file, append a stanza for each dimension extraction configuration as follows:

   [statsd-dims:<unique_transforms_stanza_name>]
   REGEX = <regular expression>
   REMOVE_DIMS_FROM_METRIC_NAME = <Boolean>
   

   • unique_transforms_stanza_name: A unique name for this stanza. Stanza names for StatsD dimension extraction configurations must be prefixed with statsd-dims:.
   • REGEX = <regular expression>: A regular expression that defines how to match and extract dimensions from StatsD metrics data. The Splunk platform supports a named capturing-group extraction format (?<dim1>group)(?<dim2>group)... to provide dimension names for the corresponding values that are extracted.
   • REMOVE_DIMS_FROM_METRIC_NAME = <Boolean>: Specifies whether unmatched segments of the StatsD dotted name segment are used as the metric_name.
     When set to true, the Splunk software removes dimension values from the measurement and the unmatched portion becomes the metric_name. This setting defaults to true. When set to false, this setting leaves extracted dimension values in the metric_name.
     For example, a metric measurement name is x.y.z. The regular expression matches y and z. When REMOVE_DIMS_FROM_METRIC_NAME is true, metric_name is x. When false, metric_name is x.y.z.
3. Save your changes to the transforms.conf file.
4. Deploy the props.conf and transforms.conf changes to your indexers, if you have any.
   Note: If you are employing heavy forwarders in front of your indexers, the props.conf and transforms.conf processing takes place on those forwarders, not the indexers. Therefore, you must deploy the props.conf changes to the heavy forwarders.

Steps for defining a custom source type for your StatsD metric data

1. In a text editor, open the props.conf configuration file from the local directory for the location you want to use, such as the Search & Reporting app ($SPLUNK_HOME/etc/apps/search/local/) or from the system ($SPLUNK_HOME/etc/system/local). If a props.conf file does not exist in this location, create a text file and save it to that location.
2. Append a stanza to the props.conf file as follows:

   [<metrics_sourcetype_name>]
   METRICS_PROTOCOL = statsd
   STATSD-DIM-TRANSFORMS = <statsd_dim_stanza_name1>,<statsd_dim_stanza_name2>...
   

   • metrics_sourcetype_name: The name of your custom metrics source type.
   • METRICS_PROTOCOL: Identifies the metrics protocol used by the incoming metric data for a metrics input. STATSD is selected here because it is a StatsD metric input.
   • STATSD-DIM-TRANSFORMS: A comma-separated list of transforms stanza names that specify how to extract dimensions. If only one stanza is used for the source type, and if the related transforms.conf stanza name is same as the metrics_sourcetype_name, this STATSD-DIM-TRANSFORMS setting can be omitted.
3. Save your changes to the props.conf file.
4. Create a data input for this source type as described in Set up a data input for StatsD data, and select your custom source type.

For more about editing these configuration files, see About configuration files, props.conf, and transforms.conf in the Admin Manual.

Examples of configuring dimension extraction

Let's say you have StatsD metrics data such as:

You need to extract the ipv4 and os dimensions.

If you defined two regular expressions, one for ipv4 and one for os, you would append the following stanzas to your configuration files:

# transforms.conf.example

[statsd-dims:regex_stanza1]
REGEX = (?<ipv4>\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})
REMOVE_DIMS_FROM_METRIC_NAME = true
[statsd-dims:regex_stanza2]
REGEX = \S+\.(?<os>\w+):
REMOVE_DIMS_FROM_METRIC_NAME = true

# props.conf.example

[my_custom_metrics_sourcetype]
METRICS_PROTOCOL = statsd
STATSD-DIM-TRANSFORMS = regex_stanza1, regex_stanza2

Now let's say you can accomplish this same extraction using a single regular expression. In this case, you would append the following stanzas to your configuration files:

# transforms.conf.example

[statsd-dims:my_custom_metrics_sourcetype]
REGEX = (?<ipv4>\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})\.(?<os>\w+):
REMOVE_DIMS_FROM_METRIC_NAME = true

# props.conf.example

[my_custom_metrics_sourcetype]
METRICS_PROTOCOL = statsd

Notice that the STATSD-DIM-TRANSFORMS setting in the props.conf configuration file is not needed when only a single regular expression is used for a source type.