topic Re: Firewall Indexing Latency in Getting Data In

Firewall Indexing Latency

hartfoml — Wed, 29 Jan 2014 22:09:00 GMT

I have my firewall sending UDP to a syslog-ng folder and Splunk is watching the file in the folder

I can see a latency for the latency like this
| eval diff_sec=(_indextime - _time)| where diff_sec > 0

But when I do a real-time search on the logs the view I get is sometimes much grater than the indexing latency

As I run the realtime search I see this as the events found and the events looked at "4,557 of 10,017 events matched"

the difference continues to grow the longer I have the realtime window open.

Why can't I see all the events that have been indexed?

Re: Firewall Indexing Latency

martin_mueller — Wed, 29 Jan 2014 23:26:33 GMT

What difference is growing, indextime vs time or scanned vs matched events?

Re: Firewall Indexing Latency

hartfoml — Thu, 30 Jan 2014 16:52:26 GMT

Martin thanks for your help,

Scanned vs matched

Re: Firewall Indexing Latency

martin_mueller — Thu, 30 Jan 2014 18:55:08 GMT

Doing a real-time search, the number of events scanned will increase for as long as the search is running. The number of matched events will rise and fall according to how many events actually do match within the window of your real-time search.