Getting Data In

Are _internal per_host_thruput logs always created for hosts logging events?

Contributor

We have seen situations where hosts logging a small number of events do not seem to be getting any _internal host_thruput_logs. Is there a certain volume amount that must be hit before a reporting hosts gets an associated _internal log?

0 Karma
1 Solution

Influencer

Only the top 10 hosts are logged this way by default. You can override this in limits.conf:

[metrics]

maxseries = <integer>
* The number of series to include in the per_x_thruput reports in metrics.log.
* Defaults to 10.

View solution in original post

Influencer

Only the top 10 hosts are logged this way by default. You can override this in limits.conf:

[metrics]

maxseries = <integer>
* The number of series to include in the per_x_thruput reports in metrics.log.
* Defaults to 10.

View solution in original post

Influencer

You can check yourself how much series are logged per interval by executing a search like this: index=_internal source=*metrics.log group=per_host_thruput | timechart span=30s dc(series) as dc_hosts | stats avg(dc_hosts) max(dc_hosts) min(dc_hosts)

0 Karma

Splunk Employee
Splunk Employee

I suspect ziegfried is correct. In any given 30-second interval, only the top 10 hosts are logged. If some hosts are never logged, it is probably because they are never in the top 10. You can have many hundreds logged if your top 10 are changing a lot.

0 Karma

Contributor

Pretty sure that it is not related to this. We have plenty of hosts (over 200+) coming into our indexers from this particular forwarder. All the hosts show up in the _internal index with per_host_thruput data apart from a handful which do not.