Reporting and squashing for volume metrics

As indexers process data, they report the source, source type, index, host, and other metadata to the license manager every minute by default.

When the number of these distinct elements exceeds a predefined threshold, the host and source values are automatically "squashed," meaning that host and source values may be partially or fully omitted to optimize performance. This process reduces memory usage, minimizes excessive log events, and lessens the load on both indexers and the license manager, while still providing accurate trends and patterns.

Impact on other metrics

• Volume metrics for indexes and source types are not affected by squashing.
• Event count metrics and latency metrics are not affected by squashing.

Dashboard notification

If squashing happens during the time period defined for a query, the dashboard will display the following message:

"Squashing has occurred during the time selected. Volume metrics are hidden by default because squashing may cause inaccurate reporting per host and source."

This notification ensures transparency and helps you interpret your metrics accurately.