Metrics.log - some information!

[verbal_666]

Hi.
I use a lot the metrics.log Indexer side, to debug some bottleneck and/or stress inside the Infrastructure.

There is a field, i can't really understand at all,

INFO  Metrics - group=tcpin_connections
x.x.x.x:50496:9997
connectionType=cookedSSL
sourcePort=50496
sourceHost=x.x.x.x
sourceIp=x.x.x.x
destPort=9997
kb=15.458984375
_tcp_avg_thruput=7.262044477222557
_tcp_Kprocessed=589.84765625
[...]

It's the "tcp_Kprocessed" field,
especially related to the field "kb", which is the most important, in my opinion.

What is in practice "tcp_Kprocessed", considering that its values are often very inconsistent and not proportionate to the kb?

Thanks.

[splunkreal]

yes, sounds logic 😉

You can add idea to document these fields at https://ideas.splunk.com/ideas/new

[verbal_666 · Accepted solution]

Yep!

Le't stay as said... if someone else wants to add something, you're welcome,

tcp_Kprocessed == Kb received by the receiver as a packet of events
kb == the real Kb (compressed) written on Indexer storage

Explicit and simple,

tcp_Kprocessed == the Networking thruput of events packet
kb == the Compressed Data written to Indexer Storage of previous packet

👍

[splunkreal]

Hello @verbal_666  I think this is the volume indexed.

[verbal_666]

I'm counting the "kb" as volume of data received and ingected into Indexers.
Is this wrong, so?

So, what's the relation beetwen "kb" and "tcp_Kprocessed" ?

I'm still in doubt 🤔🤔🤔

[splunkreal]

Seems tcp_kprocessed is total transferred data and kb the volume indexed for that particular event.

You may submit support ticket for further information as this doesn't look documented.

[verbal_666]

Maybe could be

tcp_Kprocessed == Kb received by the receiver as a packet of events
kb == the real Kb (compressed) written on Indexer storage

So, for my purposes, i keep on using the sum of "kb" as volume of data from UF to Indexers.

Yes, it's not documented at all 🙄🙄🙄🤷‍♂️

Thanks!