View data flow information about an Edge Processor

Each Edge Processor measures data flow metrics as it processes data. These metrics are sent to and read from the _metrics index of the Splunk Enterprise deployment that hosts the Edge Processor service. You can access a detailed view of a specific Edge Processor to get an overview of how that Edge Processor is configured and how data is flowing through it. Use this detailed view to review the inbound and outbound data metrics of your Edge Processor and confirm whether data is flowing through as expected.

To access a detailed view of a specific Edge Processor, do the following:

  1. Navigate to the Edge Processors page.
  2. In the row that lists the Edge Processor that you want to inspect, select the Actions icon (Image of the Actions icon) and select Open.

The detailed view of an Edge Processor displays the following data flow information. By default, these are metrics from the last 30 minutes, but you can modify the time range. These metrics are not shown in real-time, so refresh the page to see the latest.

Note: Historical metrics only include connected data sources and currently applied pipelines. If you delete a pipeline or configure a data source to no longer point to an Edge Processor, then metrics associated with them are not included in this view.
Component Information displayed
Received data
  • The source types that the connected data sources are sending to this Edge Processor.
  • The amount of data, per source type, that is being sent to this Edge Processor.
Pipelines
  • The number of pipelines that are applied to this Edge Processor.
  • The amount of outbound data that each pipeline is sending to a destination. By comparing this metric to the metric about the amount of inbound data that an Edge Processor is receiving, you can see how much data is being filtered out by each pipeline.
Edge Processor overview
  • The number of pipelines that are connected to this Edge Processor.
  • The default destination that the Edge Processor routes unprocessed data to. Edge Processors without a default destination will drop unprocessed data.
  • The number of source types that are being sent through this Edge Processor.
  • The amount of inbound data that this Edge Processor is receiving from data sources.

Note: This number includes internal events, or events with the splunkd and fwdinfo source types, and it might be higher than expected.
  • The amount of outbound data that this Edge Processor is sending to its destinations.

This data flow information provides an overview of how an Edge Processor is handling data. If you identify a problem, you can view logs to gain further insights and troubleshoot the problem. See View logs for the Edge Processor solution.

Splunk also collects the following data flow and general Edge Processor usage information:

  • Data processing volume from each edge processor

  • Edge Processor instance versions, the type of enabled receivers sending data, and status information about error and healthy states

  • Number of actively applied pipelines, pipeline destinations, and pipeline functions and usage

  • Actions taken on the Data Management service user interface

Note: This data only contains information pertaining to the operational status or overview of a given Edge Processor. They do not contain any of the actual data that you are ingesting and processing through Edge Processors.