<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: about metrics.log:name in Splunk Search</title>
    <link>https://community.splunk.com/t5/Splunk-Search/about-metrics-log-name/m-p/357828#M175099</link>
    <description>&lt;PRE&gt;&lt;CODE&gt;&amp;lt;mythbusted&amp;gt;I believe it denotes pipelines when parallelization is being used &amp;lt;\mythbusted&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;EDIT: My bad, I was thinking of Ingest_pipe=*&lt;/P&gt;

&lt;P&gt;The number on the end of the name appears to be an index of all the unique receivers in that group&lt;/P&gt;

&lt;BLOCKQUOTE&gt;
&lt;P&gt;name is a combination of conf stanza and entries that fully define the target system to the software.&lt;/P&gt;
&lt;/BLOCKQUOTE&gt;

&lt;P&gt;&lt;A href="https://docs.splunk.com/Documentation/Splunk/6.5.2/Troubleshooting/Aboutmetricslog#Tcpout_Connections_messages"&gt;https://docs.splunk.com/Documentation/Splunk/6.5.2/Troubleshooting/Aboutmetricslog#Tcpout_Connections_messages&lt;/A&gt;&lt;/P&gt;

&lt;P&gt;My tcpout_connection entry looks like this:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;name=default-autolb-group:10.10.31.83:9997:0
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;because the default-autolb-group only contains one indexer.....will add another and confirm&lt;/P&gt;

&lt;P&gt;In your example do the numbers match the amount of unique indexers?&lt;/P&gt;</description>
    <pubDate>Tue, 21 Mar 2017 05:13:40 GMT</pubDate>
    <dc:creator>mattymo</dc:creator>
    <dc:date>2017-03-21T05:13:40Z</dc:date>
    <item>
      <title>about metrics.log:name</title>
      <link>https://community.splunk.com/t5/Splunk-Search/about-metrics-log-name/m-p/357827#M175098</link>
      <description>&lt;P&gt;What is the last value of name in metrics.log?&lt;/P&gt;

&lt;P&gt;name=default-autolb-group:172.01.01.01:9997:0&lt;BR /&gt;
name=default-autolb-group:172.01.01.01:9997:1&lt;/P&gt;

&lt;P&gt;What does (0 OR 1) mean?&lt;/P&gt;</description>
      <pubDate>Thu, 16 Mar 2017 09:01:02 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/about-metrics-log-name/m-p/357827#M175098</guid>
      <dc:creator>HiroshiSatoh</dc:creator>
      <dc:date>2017-03-16T09:01:02Z</dc:date>
    </item>
    <item>
      <title>Re: about metrics.log:name</title>
      <link>https://community.splunk.com/t5/Splunk-Search/about-metrics-log-name/m-p/357828#M175099</link>
      <description>&lt;PRE&gt;&lt;CODE&gt;&amp;lt;mythbusted&amp;gt;I believe it denotes pipelines when parallelization is being used &amp;lt;\mythbusted&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;EDIT: My bad, I was thinking of Ingest_pipe=*&lt;/P&gt;

&lt;P&gt;The number on the end of the name appears to be an index of all the unique receivers in that group&lt;/P&gt;

&lt;BLOCKQUOTE&gt;
&lt;P&gt;name is a combination of conf stanza and entries that fully define the target system to the software.&lt;/P&gt;
&lt;/BLOCKQUOTE&gt;

&lt;P&gt;&lt;A href="https://docs.splunk.com/Documentation/Splunk/6.5.2/Troubleshooting/Aboutmetricslog#Tcpout_Connections_messages"&gt;https://docs.splunk.com/Documentation/Splunk/6.5.2/Troubleshooting/Aboutmetricslog#Tcpout_Connections_messages&lt;/A&gt;&lt;/P&gt;

&lt;P&gt;My tcpout_connection entry looks like this:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;name=default-autolb-group:10.10.31.83:9997:0
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;because the default-autolb-group only contains one indexer.....will add another and confirm&lt;/P&gt;

&lt;P&gt;In your example do the numbers match the amount of unique indexers?&lt;/P&gt;</description>
      <pubDate>Tue, 21 Mar 2017 05:13:40 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/about-metrics-log-name/m-p/357828#M175099</guid>
      <dc:creator>mattymo</dc:creator>
      <dc:date>2017-03-21T05:13:40Z</dc:date>
    </item>
    <item>
      <title>Re: about metrics.log:name</title>
      <link>https://community.splunk.com/t5/Splunk-Search/about-metrics-log-name/m-p/357829#M175100</link>
      <description>&lt;P&gt;Hi, mmodestino&lt;BR /&gt;
I thought so, but there are obviously more numbers than pipeline number.&lt;/P&gt;</description>
      <pubDate>Wed, 22 Mar 2017 06:18:13 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/about-metrics-log-name/m-p/357829#M175100</guid>
      <dc:creator>HiroshiSatoh</dc:creator>
      <dc:date>2017-03-22T06:18:13Z</dc:date>
    </item>
    <item>
      <title>Re: about metrics.log:name</title>
      <link>https://community.splunk.com/t5/Splunk-Search/about-metrics-log-name/m-p/357830#M175101</link>
      <description>&lt;P&gt;what do you mean?&lt;BR /&gt;
do you not have parallelization turned on?&lt;/P&gt;</description>
      <pubDate>Wed, 22 Mar 2017 10:16:32 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/about-metrics-log-name/m-p/357830#M175101</guid>
      <dc:creator>mattymo</dc:creator>
      <dc:date>2017-03-22T10:16:32Z</dc:date>
    </item>
    <item>
      <title>Re: about metrics.log:name</title>
      <link>https://community.splunk.com/t5/Splunk-Search/about-metrics-log-name/m-p/357831#M175102</link>
      <description>&lt;P&gt;ah I see what you mean...updating answer&lt;/P&gt;</description>
      <pubDate>Wed, 22 Mar 2017 13:51:43 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/about-metrics-log-name/m-p/357831#M175102</guid>
      <dc:creator>mattymo</dc:creator>
      <dc:date>2017-03-22T13:51:43Z</dc:date>
    </item>
  </channel>
</rss>

