Getting Data In

Is there an internal log in Splunk with the number of events that were sent to null queue?

jhigginsmq
Path Finder

Hi.

We have recently been inadvertently sending some events to the null queue, due to a new data source that matches a greedy regex pattern specified in transforms.conf on the indexer. We can correct the regex easily, but as I understand it, the events are lost for good as there is no copy of the raw data anywhere.

My question: is there maybe a log in Splunk that will advise on the number of events sent to the null queue? It would be good to know the fraction of incoming events being discarded, although some of these will be from a legitimate, intended match to the regex in transforms.conf.

0 Karma
1 Solution

twinspop
Influencer
index=_internal component=metrics processor=nullqueue group=pipeline sourcetype=splunkd

View solution in original post

0 Karma

somesoni2
Revered Legend

Give this a try

index=_internal sourcetype=splunkd source=*metrics.log group=pipeline processor=nullqueue | stats sum(executes) as NullQueueInvocations
0 Karma

twinspop
Influencer
index=_internal component=metrics processor=nullqueue group=pipeline sourcetype=splunkd
0 Karma

jhigginsmq
Path Finder

Thanks guys, I used up my '2 posts a day' yesterday so just responding now... I've never really looked at metrics.log before but been reading up on it, looks to be quite useful, cheers.

0 Karma

koshyk
Super Champion

Are you dropping at "heavy forwarders" or at "indexers" ?

0 Karma

jhigginsmq
Path Finder

Hi Koshyk, this would be at the indexers.

0 Karma
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...