https://community.splunk.com/t5/Getting-Data-In/Monitor-Queue-Size-Without-access-to-Search-Head-or-Apps/m-p/242025#M46905 <P>Hi All,</P> <P>Is it possible to monitor the queue size without access to the search head or related applications ?</P> <P>I currently have a general system setup: Universal Forwarder→Heavy Forwarder→Indexer→Search Head.<BR /> And only have access to the Universal and Heavy forwarders.</P> <P>I understand queue information can be found in metrics.log</P> <P>How could I approach this?</P> <P>Cheers,</P> <P>Craig</P> Mon, 22 Aug 2016 06:12:11 GMT craigwilkinson 2016-08-22T06:12:11Z https://community.splunk.com/t5/Getting-Data-In/Monitor-Queue-Size-Without-access-to-Search-Head-or-Apps/m-p/242025#M46905 <P>Hi All,</P> <P>Is it possible to monitor the queue size without access to the search head or related applications ?</P> <P>I currently have a general system setup: Universal Forwarder→Heavy Forwarder→Indexer→Search Head.<BR /> And only have access to the Universal and Heavy forwarders.</P> <P>I understand queue information can be found in metrics.log</P> <P>How could I approach this?</P> <P>Cheers,</P> <P>Craig</P> Mon, 22 Aug 2016 06:12:11 GMT https://community.splunk.com/t5/Getting-Data-In/Monitor-Queue-Size-Without-access-to-Search-Head-or-Apps/m-p/242025#M46905 craigwilkinson 2016-08-22T06:12:11Z https://community.splunk.com/t5/Getting-Data-In/Monitor-Queue-Size-Without-access-to-Search-Head-or-Apps/m-p/242026#M46906 <P>I use the following alert to determine if our queue size is too large, over a 15m period.</P> <PRE><CODE>index=_internal source=*metrics.log host=sh*.ourCloudName* | stats avg(current_size) as avg_queue_size by host | search avg_queue_size &gt; 1000 </CODE></PRE> <P>Be sure to fixup the actual host value.</P> Tue, 19 Sep 2017 21:24:48 GMT https://community.splunk.com/t5/Getting-Data-In/Monitor-Queue-Size-Without-access-to-Search-Head-or-Apps/m-p/242026#M46906 markbarber21 2017-09-19T21:24:48Z