Monitoring Splunk

In Metrics.log group=searchscheduler what is the meaning of the "eligible" metric?

fwump38
New Member

In Splunk Enterprise when looking at the metrics.log with the searchscheduler group there is a metric for "eligible" but I can't find out what this indicates.

 

index=_internal source=*metrics.log group=searchscheduler

 

For context this is on Splunk Enterprise 8.0.2006 Cloud and we have 3 search heads in a cluster.

I was able to find this documentation but in the section where it talks about groups there is nothing mentioning the searchscheduler group

Here's an example event:

 

09-29-2020 19:06:28.281 +0000 INFO  Metrics - group=searchscheduler, eligible=9, delayed=0, dispatched=0, skipped=0, total_lag=0, max_lag=0, window_max_lag=0, window_total_lag=0, max_running=3, actions_triggered=0, completed=3, total_runtime=21.251, max_runtime=19.212

 

 

The reason I am interested in this value is that when looking at all of the other metrics in this group (delegated, delegated_scheduled, delegated_waiting, dispatched, eligible, skipped, delayed, completed, actions_triggered) there was a noticeable dip in only the "eligible" metric during some periods where our alerts were not triggering actions. The dip in this metric affected only 2 out of 3 search heads.

Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Just guessing here, but I'd say "eligible" is the number of enabled scheduled searches on that search head.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...

Admin Console: A Single, Unified Interface for All Your Cloud Admin Needs

WATCH NOWJoin us to learn how the admin console can save you time and give you more control over the Splunk® ...