Splunk Search

Nullqueue Thruput Totals

ephemeric
Contributor

Hi,

Is there a search or metrics.log that one can get an idea of the amount of data/events being sent to the nullqueue because of props and transforms? I would like to see the volume of data sent away to make filter comparisons and to decrease index usage. The filters are on an intermediate forwarder and if I search for the events in question they are not appearing so I assume they work. The cumulative_hits increment steadily, is this something to go by?

I have looked at the following in metrics.log:

03-25-2011 20:38:45.477 INFO Metrics - group=pipeline, name=dev-null, processor=nullqueue, cpu_seconds=0.000000, executes=4450, cumulative_hits=3469242 03-25-2011 20:39:16.479 INFO Metrics - group=pipeline, name=dev-null, processor=nullqueue, cpu_seconds=0.000000, executes=4113, cumulative_hits=3473355

Thanks.

Tags (3)
1 Solution

jbsplunk
Splunk Employee
Splunk Employee

You can tell how many times it has been hit, but you can't tell thruput via metrics.log. That data simply is not recorded.

View solution in original post

jbsplunk
Splunk Employee
Splunk Employee

You can tell how many times it has been hit, but you can't tell thruput via metrics.log. That data simply is not recorded.

jbsplunk
Splunk Employee
Splunk Employee

There isn't any way to see the volume of data being pushed through nullQueue, no.

0 Karma

ephemeric
Contributor

The above answer is obvious. Is there any other way to see the thruput?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...