https://community.splunk.com/t5/Getting-Data-In/Clarification-on-metrics-log-on-forwarders/m-p/488130#M83551 <P>Splunk documentation about metrics.log is nice but not entirely up to date and complete according to me.</P> <UL> <LI>In section "Tcpout connections messages", we are missing the aggregation parameter for the values. Is the data reported (like _tcp_KBps) by "name", by "destIp" , by something else ... ? I've tried to figure this out by graphing _tcp_KBps over time and use different aggregation parameters but I have never been able to get a continuous line with a growing value (which should be the case).</LI> <LI>From time to time another field named "one_time_client=1" appears. What does it mean ?</LI> <LI>When UseACK is true, you get 2 additional metrics : max_ackq_size and current_ackq_size. They are not documented as far as I know, what do they mean ?</LI> </UL> Wed, 30 Sep 2020 05:14:39 GMT yoho 2020-09-30T05:14:39Z https://community.splunk.com/t5/Getting-Data-In/Clarification-on-metrics-log-on-forwarders/m-p/488130#M83551 <P>Splunk documentation about metrics.log is nice but not entirely up to date and complete according to me.</P> <UL> <LI>In section "Tcpout connections messages", we are missing the aggregation parameter for the values. Is the data reported (like _tcp_KBps) by "name", by "destIp" , by something else ... ? I've tried to figure this out by graphing _tcp_KBps over time and use different aggregation parameters but I have never been able to get a continuous line with a growing value (which should be the case).</LI> <LI>From time to time another field named "one_time_client=1" appears. What does it mean ?</LI> <LI>When UseACK is true, you get 2 additional metrics : max_ackq_size and current_ackq_size. They are not documented as far as I know, what do they mean ?</LI> </UL> Wed, 30 Sep 2020 05:14:39 GMT https://community.splunk.com/t5/Getting-Data-In/Clarification-on-metrics-log-on-forwarders/m-p/488130#M83551 yoho 2020-09-30T05:14:39Z