Hi,
I am using a universal forwarder to forward data to an indexer.
How do I measure the time taken to forward the data to indexer?
Thanks
Hi,
To get the exact time your data is spends on wire between the forwarder and indexer, you will have to check on the network front. But if you are looking to get an estimate of the difference between the time the event gets logged on your forwarder and the time it gets indexed on the indexer, you can get it by:
your search .... host=your_forwarder |eval latency=(_indextime - _time),indextime=strftime(_indextime,"%Y-%m-%d %H:%M:%S")|table _time, indextime, latency
Thanks a lot Yasaswy
if this solved your problem, please accept Yasaswy's answer.