How do i find out how long it takes Splunk to actually log events?

[Genti]

I think it is taking splunk some time to capture new events.
Is there a way to be able to tell exactly how long it takes Splunk to index new events, or even a way to tell how long it has taken for each event to get into Splunk?

[Genti · Accepted solution]

This came up yesterday when i wanted to find out if there was a difference in time between the event creation time and event logging time.
Yes, Splunk reads the timestamp from the actual event and when indexing the log puts the correct timestamp that it reads, however does this happen real time, or does it take splunk a while to have the event come in? - This is very important for alerting purposes..

So, in order to check how quickly splunk is indexing your logs you can run a search such as the following and get some pretty cool results:

<your specific search> | eval time=_time | eval indextime=_indextime | eval diff=indextime-time | where diff>=0 | convert ctime(indextime) | convert ctime(time) | fields indextime time diff