The metrics logs for thruput contain entries like this:
... kbps=8.645610, eps=0.225803, kb=268.018555, ev=7, avg_age=11.428571, max_age=16
On the indexer, ev is a count of events. But on a Forwarder (UF), Splunk has no idea what an "event" is. Props definitions that define LINE_BREAKER and friends are on the indexer. So what is ev counting? Is it configurable? In my case, it would be handy for this to show a basic line count.
↧