https://community.splunk.com/t5/Getting-Data-In/Is-indextime-set-at-parse-time-or-index-time/m-p/175487#M35231 <P>_indextime is determined in the indexing pipeline processor just before an event is written to disk, so there is little to no chance for lag introduced at that processing phase.</P> Fri, 08 May 2015 18:30:06 GMT s2_splunk 2015-05-08T18:30:06Z https://community.splunk.com/t5/Getting-Data-In/Is-indextime-set-at-parse-time-or-index-time/m-p/175486#M35230 <P>Does anyone know if the <CODE>_indextime</CODE> field is assigned during the parsing phase or when the event is written into the index? I'm assuming that, as a meta field, it is actually created at parsing time, but I'm looking for confirmation.</P> <P>Specifically, in the case of a UF -&gt; intermediate heavy forwarder -&gt; indexer, I'd like to know if event lag is occurring on the indexer. But I can't determine that if indextime is set during the parsing phase.</P> Fri, 08 May 2015 17:20:59 GMT https://community.splunk.com/t5/Getting-Data-In/Is-indextime-set-at-parse-time-or-index-time/m-p/175486#M35230 Lowell 2015-05-08T17:20:59Z https://community.splunk.com/t5/Getting-Data-In/Is-indextime-set-at-parse-time-or-index-time/m-p/175487#M35231 <P>_indextime is determined in the indexing pipeline processor just before an event is written to disk, so there is little to no chance for lag introduced at that processing phase.</P> Fri, 08 May 2015 18:30:06 GMT https://community.splunk.com/t5/Getting-Data-In/Is-indextime-set-at-parse-time-or-index-time/m-p/175487#M35231 s2_splunk 2015-05-08T18:30:06Z