Getting Data In

Monitor Queue Size Without access to Search Head or Apps

craigwilkinson
Path Finder

Hi All,

Is it possible to monitor the queue size without access to the search head or related applications ?

I currently have a general system setup: Universal Forwarder→Heavy Forwarder→Indexer→Search Head.
And only have access to the Universal and Heavy forwarders.

I understand queue information can be found in metrics.log

How could I approach this?

Cheers,

Craig

markbarber21
Path Finder

I use the following alert to determine if our queue size is too large, over a 15m period.

index=_internal source=*metrics.log host=sh*.ourCloudName*
| stats avg(current_size) as avg_queue_size by host
| search avg_queue_size > 1000

Be sure to fixup the actual host value.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...