Splunk Search

How do i find out how long it takes Splunk to actually log events?

Genti
Splunk Employee
Splunk Employee

I think it is taking splunk some time to capture new events.
Is there a way to be able to tell exactly how long it takes Splunk to index new events, or even a way to tell how long it has taken for each event to get into Splunk?

1 Solution

Genti
Splunk Employee
Splunk Employee

This came up yesterday when i wanted to find out if there was a difference in time between the event creation time and event logging time.
Yes, Splunk reads the timestamp from the actual event and when indexing the log puts the correct timestamp that it reads, however does this happen real time, or does it take splunk a while to have the event come in? - This is very important for alerting purposes..

So, in order to check how quickly splunk is indexing your logs you can run a search such as the following and get some pretty cool results:

<your specific search> | eval time=_time | eval indextime=_indextime | eval diff=indextime-time | where diff>=0 | convert ctime(indextime) | convert ctime(time) | fields indextime time diff

View solution in original post

Genti
Splunk Employee
Splunk Employee

This came up yesterday when i wanted to find out if there was a difference in time between the event creation time and event logging time.
Yes, Splunk reads the timestamp from the actual event and when indexing the log puts the correct timestamp that it reads, however does this happen real time, or does it take splunk a while to have the event come in? - This is very important for alerting purposes..

So, in order to check how quickly splunk is indexing your logs you can run a search such as the following and get some pretty cool results:

<your specific search> | eval time=_time | eval indextime=_indextime | eval diff=indextime-time | where diff>=0 | convert ctime(indextime) | convert ctime(time) | fields indextime time diff
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...