topic Re: Time difference (practical values) between event-time and index-time in large clustered environments in Getting Data In

Time difference (practical values) between event-time and index-time in large clustered environments

koshyk — Wed, 05 Apr 2017 18:38:57 GMT

I know it is a weird question (like how long piece of string), but this is more of values from your experience/real-time practical value in your large clustred environment. We are estimating for how fast Splunk can respond in real-time, but on analysing difference between _time and _indextime , the values are much higher than I thought. It is coming up in 300seconds for 90th Percentile of data.

The data comes from syslog and from Universal Forwarders.
No queueing/pipeline blocks
No delay from source as such

Just wanted to verify how you guy's systems are looking? is 300 seconds too much or good enough for most of the data?

Re: Time difference (practical values) between event-time and index-time in large clustered environments

woodcock — Wed, 05 Apr 2017 19:09:28 GMT

The normal average for file-based forwarding of events is roughly 100 seconds (syslog should be even smaller) for _indextime - _time. Anything bigger than 300 seconds should be investigated, IMHO.

Re: Time difference (practical values) between event-time and index-time in large clustered environments

koshyk — Thu, 06 Apr 2017 13:13:03 GMT

thank you mate.