Splunk Search

When filtering out events with nullqueue, how do we find the total count of events that were dropped?

New Member

Currently, we are using null queue settings on nearly 100+ servers. All the packets will get dropped at forwarders. We have violated the license a couple of times, so instead of uninstalling agents, we are using nullqueue.

We need to find the total number of events dropped at the Forwarder, so that we can procure the license and for future capacity planning. Any thoughts?

0 Karma


These are the droids you're looking for:

index=_internal component=metrics group=pipeline name=dev-null processor=nullqueue | timechart sum(executes) by host

That's assuming your forwarders send their metrics.log to the indexers, and that you have a rough idea of how big a dropped event is.

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!