Splunk Search

Nullqueue Thruput Totals

ephemeric
Contributor

Hi,

Is there a search or metrics.log that one can get an idea of the amount of data/events being sent to the nullqueue because of props and transforms? I would like to see the volume of data sent away to make filter comparisons and to decrease index usage. The filters are on an intermediate forwarder and if I search for the events in question they are not appearing so I assume they work. The cumulative_hits increment steadily, is this something to go by?

I have looked at the following in metrics.log:

03-25-2011 20:38:45.477 INFO Metrics - group=pipeline, name=dev-null, processor=nullqueue, cpu_seconds=0.000000, executes=4450, cumulative_hits=3469242 03-25-2011 20:39:16.479 INFO Metrics - group=pipeline, name=dev-null, processor=nullqueue, cpu_seconds=0.000000, executes=4113, cumulative_hits=3473355

Thanks.

Tags (3)
1 Solution

jbsplunk
Splunk Employee
Splunk Employee

You can tell how many times it has been hit, but you can't tell thruput via metrics.log. That data simply is not recorded.

View solution in original post

jbsplunk
Splunk Employee
Splunk Employee

You can tell how many times it has been hit, but you can't tell thruput via metrics.log. That data simply is not recorded.

jbsplunk
Splunk Employee
Splunk Employee

There isn't any way to see the volume of data being pushed through nullQueue, no.

0 Karma

ephemeric
Contributor

The above answer is obvious. Is there any other way to see the thruput?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...