According to the Splunk documentation1, metrics.log is a file that contains various metrics data for
reviewing product behavior, such as pipeline, queue, thruput, and tcpout_connections. Metrics.log is
stored in the _internal index by default2, which is a special index that contains internal logs and
metrics for Splunk Enterprise. The other options are false because:
main is the default index for user data, not internal data3.
_telemetry is an index that contains data collected by the Splunk Telemetry feature, which sends
anonymous usage and performance data to Splunk4.
_introspection is an index that contains data collected by the Splunk Monitoring Console, which
monitors the health and performance of Splunk components.
