topic Re: metrics.log configuration stanza in Monitoring Splunk

How to write metrics.log configuration stanza?

bogdan_nicolesc — Wed, 11 May 2022 13:32:17 GMT

Don't know if this is the right location to ask this, but i do wonder ....

I see that web_access.log is as described below:

web_access.log =>> config location \Splunk\etc\system\default\web.conf

# HTTP access log filename
log.access_file = web_access.log

# Maximum file size of the access log, in bytes
log.access_maxsize = 25000000

# Maximum number of rotated log files to retain
log.access_maxfiles = 5

But for the metrics.log, i only find this:

[source::...\\var\\log\\splunk\\metrics.log(.\d+)?]
sourcetype = splunkd

[source::...\\token_input_metrics.log(.\d+)?]
sourcetype = token_endpoint_metrics

[source::...\\http_event_collector_metrics.log(.\d+)?]
sourcetype = http_event_collector_metrics

What and from where should i read more info?

Thnx.

Re: metrics.log configuration stanza

richgalloway — Wed, 11 May 2022 12:38:11 GMT

It depends on what info you seek. Start with https://docs.splunk.com/Documentation/Splunk/8.2.6/Troubleshooting/Aboutmetricslog

Re: metrics.log configuration stanza

bogdan_nicolesc — Wed, 11 May 2022 19:23:12 GMT

Missed my question by miles, but ok 🙂 ...

I wasn't curious about what it contains, what contains, maybe will interest me in the future, what i was curious about, and didn't find any info on this anywhere, hence why i'm here, is where is it's stanza telling how big of a file to be metrigs.log and how metrigs.log.1 files shoud splunk create till rolling files.

Found that piece of info before asking this, didn't clarrify. Also, found other infos, on another question. That is entire another topic.

Re: metrics.log configuration stanza

richgalloway — Thu, 12 May 2022 14:06:52 GMT

Check out the "appender.metrics" settings in $SPLUNK_HOME/etc/log.cfg.