topic Re: Computing latency between event time, arrival, and indexing in Getting Data In

Computing latency between event time, arrival, and indexing

droth333 — Thu, 01 Dec 2011 21:48:08 GMT

I know I can get lag between the timestamp of the event, and its
index time on the indexer by using

|eval lag = _indextime - _index

Is there a value that says when it arrived on the indexer?
That would help me to know whether my indexing latency problem is
at the forwarder, at the indexer, or somewhere else.

I know these magic _* fields aren't documented, but is there such
a field as the above? Like _arrivaltime value...
Thanks.

Re: Computing latency between event time, arrival, and indexing

yannK — Tue, 20 Mar 2012 21:49:15 GMT

Good question, but there is no such value.

_time is the timestamp extracted from the events.
_indextime is the time when the event was written to the index, not when it was received by the indexer.

Re: Computing latency between event time, arrival, and indexing

bkumarm — Wed, 23 Mar 2016 12:45:05 GMT

Since this question was posted long ago? Just checking any new features added in Splunk that gives the time of arrival of log into the Universal forwarder?