SPL
Find queues that are nearly full
Description
Easily find Splunk Instances (both forwarders and full installs) that have queues that are over 80% full!
2 0
index=_internal group=queue | eval percfull=((current_size_kb/max_size_kb)*100) | search percfull>80 | dedup host, name | table _time host name current_size_kb max_size_kb
Comments
0 total
Be the first to comment on this SPL.
Leave a comment
You must log in to post a comment.