Splunk Search

Nullqueue Thruput Totals

ephemeric
Contributor

Hi,

Is there a search or metrics.log that one can get an idea of the amount of data/events being sent to the nullqueue because of props and transforms? I would like to see the volume of data sent away to make filter comparisons and to decrease index usage. The filters are on an intermediate forwarder and if I search for the events in question they are not appearing so I assume they work. The cumulative_hits increment steadily, is this something to go by?

I have looked at the following in metrics.log:

03-25-2011 20:38:45.477 INFO Metrics - group=pipeline, name=dev-null, processor=nullqueue, cpu_seconds=0.000000, executes=4450, cumulative_hits=3469242 03-25-2011 20:39:16.479 INFO Metrics - group=pipeline, name=dev-null, processor=nullqueue, cpu_seconds=0.000000, executes=4113, cumulative_hits=3473355

Thanks.

Tags (3)
1 Solution

jbsplunk
Splunk Employee
Splunk Employee

You can tell how many times it has been hit, but you can't tell thruput via metrics.log. That data simply is not recorded.

View solution in original post

jbsplunk
Splunk Employee
Splunk Employee

You can tell how many times it has been hit, but you can't tell thruput via metrics.log. That data simply is not recorded.

jbsplunk
Splunk Employee
Splunk Employee

There isn't any way to see the volume of data being pushed through nullQueue, no.

0 Karma

ephemeric
Contributor

The above answer is obvious. Is there any other way to see the thruput?

0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...