According to the Splunk documentation1, metrics.log is a file that contains various metrics data for reviewing product behavior, such as pipeline, queue, thruput, and tcpout_connections. Metrics.log is stored in the
_internal index by default2, which is a special index that contains internal logs and metrics for Splunk Enterprise. The other options are false because:
* main is the default index for user data, not internal data3.
* _telemetry is an index that contains data collected by the Splunk Telemetry feature, which sends anonymous usage and performance data to Splunk4.
* _introspection is an index that contains data collected by the Splunk Monitoring Console, which monitors the health and performance of Splunk components.