These are the events I get from searching index=_internal group=per_source_thruput series=/znfs200g/mainframe/* around the time the files were available to read, on the host that runs the forwarder:
03-14-2018 16:03:43.705 -0400 INFO Metrics - group=per_source_thruput, series="/znfs200g/mainframe/splunk_sbss/sbssreport20180314160052.sbss", kbps=0.12758116517915236, eps=0.09677267640255705, kb=3.955078125, ev=3, avg_age=0.3333333333333333, max_age=1
03-14-2018 16:03:43.705 -0400 INFO Metrics - group=per_source_thruput, series="/znfs200g/mainframe/splunk_sbss/sbssreport20180314160045.sbss", kbps=0.11482304866123712, eps=0.09677267640255705, kb=3.5595703125, ev=3, avg_age=0.3333333333333333, max_age=1
03-14-2018 16:03:43.696 -0400 INFO Metrics - group=per_source_thruput, series="/znfs200g/mainframe/splunk_sbss/sbssreport20180314160039.sbss", kbps=0.11227142535765408, eps=0.09677267640255705, kb=3.48046875, ev=3, avg_age=0.6666666666666666, max_age=2
03-14-2018 16:03:12.700 -0400 INFO Metrics - group=per_source_thruput, series="/znfs200g/mainframe/splunk_sbss/sbssreport20180314160033.sbss", kbps=0.10972050637789256, eps=0.06451553174330289, kb=3.4013671875, ev=2, avg_age=0.5, max_age=1
03-14-2018 16:03:12.700 -0400 INFO Metrics - group=per_source_thruput, series="/znfs200g/mainframe/splunk_sbss/sbssreport20180314160028.sbss", kbps=0.10972050637789256, eps=0.09677329761495433, kb=3.4013671875, ev=3, avg_age=0.3333333333333333, max_age=1
03-14-2018 16:03:12.696 -0400 INFO Metrics - group=per_source_thruput, series="/znfs200g/mainframe/splunk_sbss/sbssreport20180314160021.sbss", kbps=0.10972050637789256, eps=0.09677329761495433, kb=3.4013671875, ev=3, avg_age=0.3333333333333333, max_age=1
03-14-2018 16:03:12.695 -0400 INFO Metrics - group=per_source_thruput, series="/znfs200g/mainframe/splunk_sbss/sbssreport20180314160017.sbss", kbps=0.11227214606109936, eps=0.09677329761495433, kb=3.48046875, ev=3, avg_age=0.3333333333333333, max_age=1
03-14-2018 16:03:12.695 -0400 INFO Metrics - group=per_source_thruput, series="/znfs200g/mainframe/splunk_sbss/sbssreport20180314160013.sbss", kbps=0.11992706511071978, eps=0.09677329761495433, kb=3.7177734375, ev=3, avg_age=0.3333333333333333, max_age=1
03-14-2018 16:03:12.695 -0400 INFO Metrics - group=per_source_thruput, series="/znfs200g/mainframe/splunk_sbss/sbssreport20180314160010.sbss", kbps=0.10972050637789256, eps=0.09677329761495433, kb=3.4013671875, ev=3, avg_age=0.6666666666666666, max_age=2
03-14-2018 16:02:41.696 -0400 INFO Metrics - group=per_source_thruput, series="/znfs200g/mainframe/splunk_sbss/sbssreport20180314160004.sbss", kbps=0.1097195401470167, eps=0.06451496360065753, kb=3.4013671875, ev=2, avg_age=0.5, max_age=1
03-14-2018 16:02:41.695 -0400 INFO Metrics - group=per_source_thruput, series="/znfs200g/mainframe/splunk_sbss/sbssreport20180314155953.sbss", kbps=0.1097195401470167, eps=0.0967724454009863, kb=3.4013671875, ev=3, avg_age=0.3333333333333333, max_age=1
For reference, these are the files and their mod times:
-rw-rw-r-- 1 root other 68607 Mar 14 15:58 XSDReport20180314.sbss
-rw-rw-r-- 1 root other 3483 Mar 14 16:02 sbssReport20180314155953.sbss
-rw-rw-r-- 1 root other 3483 Mar 14 16:02 sbssReport20180314160004.sbss
-rw-rw-r-- 1 root other 3483 Mar 14 16:02 sbssReport20180314160010.sbss
-rw-rw-r-- 1 root other 3807 Mar 14 16:02 sbssReport20180314160013.sbss
-rw-rw-r-- 1 root other 3564 Mar 14 16:02 sbssReport20180314160017.sbss
-rw-rw-r-- 1 root other 3483 Mar 14 16:02 sbssReport20180314160021.sbss
-rw-rw-r-- 1 root other 3483 Mar 14 16:03 sbssReport20180314160028.sbss
-rw-rw-r-- 1 root other 3483 Mar 14 16:03 sbssReport20180314160033.sbss
-rw-rw-r-- 1 root other 3564 Mar 14 16:03 sbssReport20180314160039.sbss
-rw-rw-r-- 1 root other 3645 Mar 14 16:03 sbssReport20180314160045.sbss
-rw-rw-r-- 1 root other 4050 Mar 14 16:03 sbssReport20180314160052.sbss
... View more