Getting Data In

Clarification on metrics.log (on forwarders)


Splunk documentation about metrics.log is nice but not entirely up to date and complete according to me.

  • In section "Tcpout connections messages", we are missing the aggregation parameter for the values. Is the data reported (like _tcp_KBps) by "name", by "destIp" , by something else ... ? I've tried to figure this out by graphing _tcp_KBps over time and use different aggregation parameters but I have never been able to get a continuous line with a growing value (which should be the case).
  • From time to time another field named "one_time_client=1" appears. What does it mean ?
  • When UseACK is true, you get 2 additional metrics : max_ackq_size and current_ackq_size. They are not documented as far as I know, what do they mean ?
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...