Getting Data In

Monitor Queue Size Without access to Search Head or Apps

Path Finder

Hi All,

Is it possible to monitor the queue size without access to the search head or related applications ?

I currently have a general system setup: Universal Forwarder→Heavy Forwarder→Indexer→Search Head.
And only have access to the Universal and Heavy forwarders.

I understand queue information can be found in metrics.log

How could I approach this?



Path Finder

I use the following alert to determine if our queue size is too large, over a 15m period.

index=_internal source=*metrics.log host=sh*.ourCloudName*
| stats avg(current_size) as avg_queue_size by host
| search avg_queue_size > 1000

Be sure to fixup the actual host value.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!