Splunk Infrastructure Monitoring Add-on (SIM): Updated Custom Property Not Reflected in Metric Fields

Applicability

Description

When the name of an already-configured test in Synthetic Monitoring is changed or when custom properties are updated in the Observability platform, the corresponding fields in the ingested metric data may not reflect the updates immediately in Splunk Cloud. This behavior is due to limitations in how metadata is associated with existing Metric Time Series (MTS) IDs.

Investigation

• In the current version of the Observability platform, custom properties do not influence Metric Time Series (MTS) ID generation.

• When a custom property is added, updated, or removed, the platform continues to use the existing MTS ID associated with that metric stream.

• Because the MTS ID remains unchanged, no new metadata event is emitted to reflect the updated properties.

• As a result, downstream systems such as Splunk continue to receive metrics tied to the old MTS ID, which does not contain the new or updated custom properties.

• For example, if a new custom property is added (e.g., cp6), it is not visible in Splunk unless the flow query in SignalFx explicitly promotes that field using a function like promote("cp6"), which is not considered a feasible or scalable solution.

• This behavior is confirmed to be a current limitation of the O11y platform and is expected to be addressed in Metrics 2.0, where improvements in metadata propagation and MTS handling are planned.

Resolution

To force immediate reflection of custom property changes in the ingested metrics:

• • Option 1: Disable and re-enable the respective input in the Splunk Add-on for Infrastructure Monitoring.

  • Option 2: Restart the Splunk instance where the input is configured.