Splunk Search

Nullqueue Thruput Totals

ephemeric
Contributor

Hi,

Is there a search or metrics.log that one can get an idea of the amount of data/events being sent to the nullqueue because of props and transforms? I would like to see the volume of data sent away to make filter comparisons and to decrease index usage. The filters are on an intermediate forwarder and if I search for the events in question they are not appearing so I assume they work. The cumulative_hits increment steadily, is this something to go by?

I have looked at the following in metrics.log:

03-25-2011 20:38:45.477 INFO Metrics - group=pipeline, name=dev-null, processor=nullqueue, cpu_seconds=0.000000, executes=4450, cumulative_hits=3469242 03-25-2011 20:39:16.479 INFO Metrics - group=pipeline, name=dev-null, processor=nullqueue, cpu_seconds=0.000000, executes=4113, cumulative_hits=3473355

Thanks.

Tags (3)
1 Solution

jbsplunk
Splunk Employee
Splunk Employee

You can tell how many times it has been hit, but you can't tell thruput via metrics.log. That data simply is not recorded.

View solution in original post

jbsplunk
Splunk Employee
Splunk Employee

You can tell how many times it has been hit, but you can't tell thruput via metrics.log. That data simply is not recorded.

jbsplunk
Splunk Employee
Splunk Employee

There isn't any way to see the volume of data being pushed through nullQueue, no.

0 Karma

ephemeric
Contributor

The above answer is obvious. Is there any other way to see the thruput?

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...