Why are universal forwarders reporting error "Metric with the name thruput:thruput already registered"?

[pilzi81]

Hi there,

By examining the _internal logs I found the following, Metric Error:

ERROR Metrics - Metric with name thruput:thruput already registered

It is reported by Universal Forwarders of several Clients spread over the entire day (with peaks in the morning hours - so I suppose that it's related to the client's start-up)

The interesting thing is, that all of these clients are still reporting events to the Indexers...

Questions:
Why does this happen?
And how can I avoid this?

thx

[tskht]

When I installed and started Universal Forwarder 9.1.0.1, the following ERROR occurred:

ERROR Metrics - Metric with name='thruput:thruput' already registered
ERROR Metrics - Metric with name='thruput:idxSummary' already registered

Is this issue still persisting even with version 9.1.0.1?

[LCanac31]

Hello i have this issue on each restart of UF 7.0.8, is there some updates?
Thanks

[jnew_splunk]

This is a known Universal Forwarder issue (SPL-103209) effecting 6.3 and above. Currently there is no patch but the error is benign and can be ignored.

[ss026381]

Although we see events from the forwarder but we see this error. Any idea what this error means?

[Kieffer87]

We are also experiencing this on our universal forwarders.

[adonio]

do you get this error on both windows and linux forwarders or windows only?

[pilzi81]

Since I created this thread I've seen this error on different UF versions (6.3.x, 6.4.x and our most recent UF version 6.5.3) as well as on different OS (windows, linux, macOS).

[Kieffer87]

I get it on both but far more windows than linux. Also not all forwarders are experiencing this error despite running the same 6.5.3 version of Splunk.

[skalliger]

Sorry for bringing up this old thread but are there any news about this? We ran into the same issue on our UF (version 6.5.0).