Indexing: Inputs: Data Quality
This topic is a reference for the Data Quality dashboard in the Monitoring Console. See About the Monitoring Console.
What does this dashboard show?
This dashboard report issues with event processing, such as:
- automatic source typing
- line breaking
- time stamp extraction
- time zone detection
- line merging
- excessively large events (high line count and/or large event size,
len(_raw)) - indexing latency (
_indextime - _time)
Interpret results in this dashboard
See Resolve data quality issues in Getting Data In.
What to look for in this dashboard
The Event processing issues by source type panel contains a table. If the table shows numbers in any of the cells, click for more information and to get started resolving issues.
Troubleshoot this dashboard
This dashboard uses data from splunkd.log.
If the drilldowns are loading slowly, you might have more issues than the drilldown searches can handle reasonably. Try narrowing the time range at the top of the page.
| Indexing: Inputs: HTTP Event Collector | Indexing: License Usage |
This documentation applies to the following versions of Splunk® Enterprise: 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9, 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.0.9, 8.0.10
Download manual
Feedback submitted, thanks!