- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Why are universal forwarders reporting error "Metr...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Why are universal forwarders reporting error "Metric with the name thruput:thruput already registered"?
Hi there,
By examining the _internal logs I found the following, Metric Error:
ERROR Metrics - Metric with name thruput:thruput already registered
It is reported by Universal Forwarders of several Clients spread over the entire day (with peaks in the morning hours - so I suppose that it's related to the client's start-up)
The interesting thing is, that all of these clients are still reporting events to the Indexers...
Questions:
Why does this happen?
And how can I avoid this?
thx
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
When I installed and started Universal Forwarder 9.1.0.1, the following ERROR occurred:
ERROR Metrics - Metric with name='thruput:thruput' already registered
ERROR Metrics - Metric with name='thruput:idxSummary' already registered
Is this issue still persisting even with version 9.1.0.1?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello i have this issue on each restart of UF 7.0.8, is there some updates?
Thanks
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This is a known Universal Forwarder issue (SPL-103209) effecting 6.3 and above. Currently there is no patch but the error is benign and can be ignored.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Although we see events from the forwarder but we see this error. Any idea what this error means?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
We are also experiencing this on our universal forwarders.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
do you get this error on both windows and linux forwarders or windows only?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Since I created this thread I've seen this error on different UF versions (6.3.x, 6.4.x and our most recent UF version 6.5.3) as well as on different OS (windows, linux, macOS).
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I get it on both but far more windows than linux. Also not all forwarders are experiencing this error despite running the same 6.5.3 version of Splunk.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Sorry for bringing up this old thread but are there any news about this? We ran into the same issue on our UF (version 6.5.0).
Enterprise Security Content Update (ESCU) | New Releases
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
Index This | What are the 12 Days of Splunk-mas?
