When filtering out events with nullqueue, how do we find the total count of events that were dropped?

[spectrum_2k3]

Currently, we are using null queue settings on nearly 100+ servers. All the packets will get dropped at forwarders. We have violated the license a couple of times, so instead of uninstalling agents, we are using nullqueue.

We need to find the total number of events dropped at the Forwarder, so that we can procure the license and for future capacity planning. Any thoughts?

[martin_mueller]

These are the droids you're looking for:

index=_internal component=metrics group=pipeline name=dev-null processor=nullqueue | timechart sum(executes) by host

That's assuming your forwarders send their metrics.log to the indexers, and that you have a rough idea of how big a dropped event is.