topic Metrics.log - some information! in Splunk Enterprise

Metrics.log - some information!

verbal_666 — Wed, 13 Dec 2023 13:38:23 GMT

Hi.
I use a lot the metrics.log Indexer side, to debug some bottleneck and/or stress inside the Infrastructure.

There is a field, i can't really understand at all,

INFO Metrics - group=tcpin_connections x.x.x.x:50496:9997 connectionType=cookedSSL sourcePort=50496 sourceHost=x.x.x.x sourceIp=x.x.x.x destPort=9997 kb=15.458984375 _tcp_avg_thruput=7.262044477222557 _tcp_Kprocessed=589.84765625 [...]

It's the "tcp_Kprocessed" field,
especially related to the field "kb", which is the most important, in my opinion.

What is in practice "tcp_Kprocessed", considering that its values are often very inconsistent and not proportionate to the kb?

Thanks.

Re: Metrics.log - some information!

splunkreal — Fri, 15 Dec 2023 14:23:13 GMT

Hello @verbal_666 I think this is the volume indexed.

Re: Metrics.log - some information!

verbal_666 — Fri, 15 Dec 2023 14:35:43 GMT

I'm counting the "kb" as volume of data received and ingected into Indexers.
Is this wrong, so?

So, what's the relation beetwen "kb" and "tcp_Kprocessed" ?

I'm still in doubt 🤔🤔🤔

Re: Metrics.log - some information!

splunkreal — Fri, 15 Dec 2023 14:41:21 GMT

Seems tcp_kprocessed is total transferred data and kb the volume indexed for that particular event.

You may submit support ticket for further information as this doesn't look documented.

Re: Metrics.log - some information!

verbal_666 — Fri, 15 Dec 2023 14:47:17 GMT

Maybe could be

tcp_Kprocessed == Kb received by the receiver as a packet of events
kb == the real Kb (compressed) written on Indexer storage

So, for my purposes, i keep on using the sum of "kb" as volume of data from UF to Indexers.

Yes, it's not documented at all 🙄🙄🙄🤷‍♂️

Thanks!

Re: Metrics.log - some information!

splunkreal — Fri, 15 Dec 2023 14:49:03 GMT

yes, sounds logic 😉

You can add idea to document these fields at https://ideas.splunk.com/ideas/new

Re: Metrics.log - some information!

verbal_666 — Sat, 16 Dec 2023 08:04:51 GMT

Yep!

Le't stay as said... if someone else wants to add something, you're welcome,

tcp_Kprocessed == Kb received by the receiver as a packet of events
kb == the real Kb (compressed) written on Indexer storage

Explicit and simple,

tcp_Kprocessed == the Networking thruput of events packet
kb == the Compressed Data written to Indexer Storage of previous packet

👍