Splunk Search

Nullqueue Thruput Totals

ephemeric
Contributor

Hi,

Is there a search or metrics.log that one can get an idea of the amount of data/events being sent to the nullqueue because of props and transforms? I would like to see the volume of data sent away to make filter comparisons and to decrease index usage. The filters are on an intermediate forwarder and if I search for the events in question they are not appearing so I assume they work. The cumulative_hits increment steadily, is this something to go by?

I have looked at the following in metrics.log:

03-25-2011 20:38:45.477 INFO Metrics - group=pipeline, name=dev-null, processor=nullqueue, cpu_seconds=0.000000, executes=4450, cumulative_hits=3469242 03-25-2011 20:39:16.479 INFO Metrics - group=pipeline, name=dev-null, processor=nullqueue, cpu_seconds=0.000000, executes=4113, cumulative_hits=3473355

Thanks.

Tags (3)
1 Solution

jbsplunk
Splunk Employee
Splunk Employee

You can tell how many times it has been hit, but you can't tell thruput via metrics.log. That data simply is not recorded.

View solution in original post

jbsplunk
Splunk Employee
Splunk Employee

You can tell how many times it has been hit, but you can't tell thruput via metrics.log. That data simply is not recorded.

jbsplunk
Splunk Employee
Splunk Employee

There isn't any way to see the volume of data being pushed through nullQueue, no.

0 Karma

ephemeric
Contributor

The above answer is obvious. Is there any other way to see the thruput?

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...