Getting Data In

Monitor Queue Size Without access to Search Head or Apps

Path Finder

Hi All,

Is it possible to monitor the queue size without access to the search head or related applications ?

I currently have a general system setup: Universal Forwarder→Heavy Forwarder→Indexer→Search Head.
And only have access to the Universal and Heavy forwarders.

I understand queue information can be found in metrics.log

How could I approach this?

Cheers,

Craig

Path Finder

I use the following alert to determine if our queue size is too large, over a 15m period.

index=_internal source=*metrics.log host=sh*.ourCloudName*
| stats avg(current_size) as avg_queue_size by host
| search avg_queue_size > 1000

Be sure to fixup the actual host value.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!