I want to have a bigger picture on sourcetypes/indexes in the metrics.log. The default "series" shown in metrics is 10..
maxseries = <integer>
* The number of series to include in the per_x_thruput reports in metrics.log.
* Defaults to 10.
If there is over 500 source types, it would make sense to set the maxseries value in limits.conf to accommodate for all the series/sourcetypes that will log information in the metrics.log
My concern is that if this number is very high, there will be more resources allocated to the logging of metrics.log. How can we measure the impact if it is set to 500? Will there be any impact?
Try it in a test environment first.
How will I judge if there is an impact in performance? Just by running a search to see if it took longer to load? Is there a way to measure the difference? Even if it is a small change?