Splunk metrics.log for indexers "out.drop"

[jw220635]

When searching in metrics.log for the indexers in SplunkCloud I'm seeing the following:

group=pipeline, name=typing, processor=regexreplacement, cpu_seconds=0.002, executes=838, cumulative_hits=10378371, in=113716, out.splunk=111870, out.drop=1846

What is out.drop telling me here?  Am I losing data and what do I need to configure to not lose data?

[richgalloway · Accepted solution]

It looks like you have a transform that employs a regular expression (regex).  This log entry is showing some metrics that result from that regex.  out.splunk would be how much was indexed (unless dropped by another transform) and out.drop is how much was not indexed.