Splunk documentation about metrics.log is nice but not entirely up to date and complete according to me.
- In section "Tcpout connections messages", we are missing the aggregation parameter for the values. Is the data reported (like _tcp_KBps) by "name", by "destIp" , by something else ... ? I've tried to figure this out by graphing _tcp_KBps over time and use different aggregation parameters but I have never been able to get a continuous line with a growing value (which should be the case).
- From time to time another field named "one_time_client=1" appears. What does it mean ?
- When UseACK is true, you get 2 additional metrics : max_ackq_size and current_ackq_size. They are not documented as far as I know, what do they mean ?
