Events Sent to Null Que – Internal Logs

This will show events that have been sent to the null que within the splunk internal logs.

 

index=_internal component=metrics processor=nullqueue group=pipeline sourcetype=splunkd | table _time log_level name processor cpu_seconds executes, cumulative_hits
Share This:

Leave A Comment?