Splunk® Enterprise

Monitor and Troubleshoot ingestion

Preview features described in this document are provided by Splunk to you "as is" without any warranties, maintenance and support, or service-level commitments. Splunk makes this preview feature available in its sole discretion and may discontinue it at any time. These documents are not yet publicly available and we ask that you keep such information confidential.
This documentation does not apply to the most recent version of Splunk® Enterprise. For documentation on the most recent version, go to the latest release.

About metrics in the Data Monitoring dashboard

Metrics displayed in the data monitoring dashboard are based on results from scheduled searches. The Data Monitoring dashboard starts running these searches as soon as the Data Monitoring app is installed. These scheduled searches are run on License Usage logs from _internal index (index=_internal source= license_usage.log).

Searches are performed in five minute intervals. For example, five minutes after installation, your dashboard will show five minutes of data, ten minutes of data in ten minutes, etc. This means that Splunk may temporarily display empty or incomplete results as the metrics build up over time. The calculated metrics are stored in a metrics index called "gdi_summary_metrics" which is created using indexes.conf.

Scheduled searches start running when the app is installed and the app does not run searches for historical time periods, therefore the app only provides visibility or metrics from the installation time onwards.

Last modified on 21 January, 2025
Terms   Data squashing impact on data monitoring

This documentation applies to the following versions of Splunk® Enterprise: DataMonitoringAppPreview

Acrobat logo Download manual
Acrobat logo Download this page

Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters