Getting Data In

Computing latency between event time, arrival, and indexing

droth333
Explorer

I know I can get lag between the timestamp of the event, and its
index time on the indexer by using

|eval lag = _indextime - _index

Is there a value that says when it arrived on the indexer?
That would help me to know whether my indexing latency problem is
at the forwarder, at the indexer, or somewhere else.

I know these magic _* fields aren't documented, but is there such
a field as the above? Like _arrivaltime value...
Thanks.

1 Solution

yannK
Splunk Employee
Splunk Employee

Good question, but there is no such value.

_time is the timestamp extracted from the events.
_indextime is the time when the event was written to the index, not when it was received by the indexer.

View solution in original post

bkumarm
Contributor

Since this question was posted long ago? Just checking any new features added in Splunk that gives the time of arrival of log into the Universal forwarder?

0 Karma

yannK
Splunk Employee
Splunk Employee

Good question, but there is no such value.

_time is the timestamp extracted from the events.
_indextime is the time when the event was written to the index, not when it was received by the indexer.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...