Getting Data In

Clarification on metrics.log (on forwarders)

yoho
Contributor

Splunk documentation about metrics.log is nice but not entirely up to date and complete according to me.

  • In section "Tcpout connections messages", we are missing the aggregation parameter for the values. Is the data reported (like _tcp_KBps) by "name", by "destIp" , by something else ... ? I've tried to figure this out by graphing _tcp_KBps over time and use different aggregation parameters but I have never been able to get a continuous line with a growing value (which should be the case).
  • From time to time another field named "one_time_client=1" appears. What does it mean ?
  • When UseACK is true, you get 2 additional metrics : max_ackq_size and current_ackq_size. They are not documented as far as I know, what do they mean ?
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...