Getting Data In

Monitor Queue Size Without access to Search Head or Apps

craigwilkinson
Path Finder

Hi All,

Is it possible to monitor the queue size without access to the search head or related applications ?

I currently have a general system setup: Universal Forwarder→Heavy Forwarder→Indexer→Search Head.
And only have access to the Universal and Heavy forwarders.

I understand queue information can be found in metrics.log

How could I approach this?

Cheers,

Craig

markbarber21
Path Finder

I use the following alert to determine if our queue size is too large, over a 15m period.

index=_internal source=*metrics.log host=sh*.ourCloudName*
| stats avg(current_size) as avg_queue_size by host
| search avg_queue_size > 1000

Be sure to fixup the actual host value.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.