Is it possible to monitor the queue size without access to the search head or related applications ?
I currently have a general system setup: Universal Forwarder→Heavy Forwarder→Indexer→Search Head.
And only have access to the Universal and Heavy forwarders.
I understand queue information can be found in metrics.log
How could I approach this?
I use the following alert to determine if our queue size is too large, over a 15m period.
index=_internal source=*metrics.log host=sh*.ourCloudName*
| stats avg(current_size) as avg_queue_size by host
| search avg_queue_size > 1000
Be sure to fixup the actual host value.