Splunk Search

about metrics.log:name

HiroshiSatoh
Champion

What is the last value of name in metrics.log?

name=default-autolb-group:172.01.01.01:9997:0
name=default-autolb-group:172.01.01.01:9997:1

What does (0 OR 1) mean?

Tags (1)
0 Karma
1 Solution

mattymo
Splunk Employee
Splunk Employee
<mythbusted>I believe it denotes pipelines when parallelization is being used <\mythbusted>

EDIT: My bad, I was thinking of Ingest_pipe=*

The number on the end of the name appears to be an index of all the unique receivers in that group

name is a combination of conf stanza and entries that fully define the target system to the software.

https://docs.splunk.com/Documentation/Splunk/6.5.2/Troubleshooting/Aboutmetricslog#Tcpout_Connection...

My tcpout_connection entry looks like this:

name=default-autolb-group:10.10.31.83:9997:0

because the default-autolb-group only contains one indexer.....will add another and confirm

In your example do the numbers match the amount of unique indexers?

- MattyMo

View solution in original post

0 Karma

mattymo
Splunk Employee
Splunk Employee
<mythbusted>I believe it denotes pipelines when parallelization is being used <\mythbusted>

EDIT: My bad, I was thinking of Ingest_pipe=*

The number on the end of the name appears to be an index of all the unique receivers in that group

name is a combination of conf stanza and entries that fully define the target system to the software.

https://docs.splunk.com/Documentation/Splunk/6.5.2/Troubleshooting/Aboutmetricslog#Tcpout_Connection...

My tcpout_connection entry looks like this:

name=default-autolb-group:10.10.31.83:9997:0

because the default-autolb-group only contains one indexer.....will add another and confirm

In your example do the numbers match the amount of unique indexers?

- MattyMo
0 Karma

HiroshiSatoh
Champion

Hi, mmodestino
I thought so, but there are obviously more numbers than pipeline number.

0 Karma

mattymo
Splunk Employee
Splunk Employee

what do you mean?
do you not have parallelization turned on?

- MattyMo
0 Karma

mattymo
Splunk Employee
Splunk Employee

ah I see what you mean...updating answer

- MattyMo
0 Karma
Get Updates on the Splunk Community!

Cloud Platform | Customer Change Announcement: Email Notification Will Be Available ...

The Notification Team is migrating our email service provider since, currently there’s no support for email ...

Save the Date: GovSummit Returns Wednesday, December 11th!

Hey there, Splunk Community! Exciting news: Splunk’s GovSummit 2024 is returning to Washington, D.C. on ...

What’s New With SOAR 6.3

Register here for our Security Edition Tech Talk on Wednesday, October 2 , 2024  |  11AM–12PM PTTune in to see ...