Getting Data In

Are _internal per_host_thruput logs always created for hosts logging events?

pj
Contributor

We have seen situations where hosts logging a small number of events do not seem to be getting any _internal host_thruput_logs. Is there a certain volume amount that must be hit before a reporting hosts gets an associated _internal log?

0 Karma
1 Solution

ziegfried
Influencer

Only the top 10 hosts are logged this way by default. You can override this in limits.conf:

[metrics]

maxseries = <integer>
* The number of series to include in the per_x_thruput reports in metrics.log.
* Defaults to 10.

View solution in original post

ziegfried
Influencer

Only the top 10 hosts are logged this way by default. You can override this in limits.conf:

[metrics]

maxseries = <integer>
* The number of series to include in the per_x_thruput reports in metrics.log.
* Defaults to 10.

ziegfried
Influencer

You can check yourself how much series are logged per interval by executing a search like this: index=_internal source=*metrics.log group=per_host_thruput | timechart span=30s dc(series) as dc_hosts | stats avg(dc_hosts) max(dc_hosts) min(dc_hosts)

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

I suspect ziegfried is correct. In any given 30-second interval, only the top 10 hosts are logged. If some hosts are never logged, it is probably because they are never in the top 10. You can have many hundreds logged if your top 10 are changing a lot.

0 Karma

pj
Contributor

Pretty sure that it is not related to this. We have plenty of hosts (over 200+) coming into our indexers from this particular forwarder. All the hosts show up in the _internal index with per_host_thruput data apart from a handful which do not.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...