How to write metrics.log configuration stanza?

[bogdan_nicolesc]

Don't know if this is the right location to ask this, but i do wonder ....


I see that web_access.log is as described below:

web_access.log =>> config location \Splunk\etc\system\default\web.conf

# HTTP access log filename
log.access_file = web_access.log

# Maximum file size of the access log, in bytes
log.access_maxsize = 25000000

# Maximum number of rotated log files to retain
log.access_maxfiles = 5

But for the metrics.log, i only find this:

[source::...\\var\\log\\splunk\\metrics.log(.\d+)?]
sourcetype = splunkd

[source::...\\token_input_metrics.log(.\d+)?]
sourcetype = token_endpoint_metrics

[source::...\\http_event_collector_metrics.log(.\d+)?]
sourcetype = http_event_collector_metrics


What and from where should i read more info?

Thnx.

[richgalloway]

It depends on what info you seek.  Start with https://docs.splunk.com/Documentation/Splunk/8.2.6/Troubleshooting/Aboutmetricslog

[bogdan_nicolesc]

Missed my question by miles, but ok 🙂 ...

I wasn't curious about what it contains, what contains, maybe will interest me in the future, what i was curious about, and didn't find any info on this anywhere, hence why i'm here, is where is it's stanza telling how big of a file to be metrigs.log and how metrigs.log.1  files shoud splunk create till rolling files.

Found that piece of info before asking this, didn't clarrify. Also, found other infos, on another question. That is entire another topic.

[richgalloway]

Check out the "appender.metrics" settings in $SPLUNK_HOME/etc/log.cfg.