https://community.splunk.com/t5/Getting-Data-In/Delay-in-logs-from-Incapsula-to-S3-Bucket/m-p/392056#M95641 <P>Morning Guys,</P> <P>We are currently having an issue with our Incapsula WAF sending logs to our AWS s3 Bucket with a delay and hoping to use a query within Splunk to provide evidence of these delays.</P> <P>So far I have got as far as the following:</P> <P>index=incapsula | eval delay_sec=_indextime-_time | convert ctime(_indextime) AS indextime | eval now=now() | table _time indextime now date_zone source sourcetype host</P> <P>This gives a table similar to what I am after, however Im looking for the actual time stamps (epoch) on the events as they happened and the actual time the log file arrived in the s3 bucket rather than the time the log file arrived at the index, any thoughts on how to modify this query to get the necessary information at all?</P> <P>Cheers guys</P> Tue, 29 Sep 2020 23:18:34 GMT brewster88 2020-09-29T23:18:34Z https://community.splunk.com/t5/Getting-Data-In/Delay-in-logs-from-Incapsula-to-S3-Bucket/m-p/392056#M95641 <P>Morning Guys,</P> <P>We are currently having an issue with our Incapsula WAF sending logs to our AWS s3 Bucket with a delay and hoping to use a query within Splunk to provide evidence of these delays.</P> <P>So far I have got as far as the following:</P> <P>index=incapsula | eval delay_sec=_indextime-_time | convert ctime(_indextime) AS indextime | eval now=now() | table _time indextime now date_zone source sourcetype host</P> <P>This gives a table similar to what I am after, however Im looking for the actual time stamps (epoch) on the events as they happened and the actual time the log file arrived in the s3 bucket rather than the time the log file arrived at the index, any thoughts on how to modify this query to get the necessary information at all?</P> <P>Cheers guys</P> Tue, 29 Sep 2020 23:18:34 GMT https://community.splunk.com/t5/Getting-Data-In/Delay-in-logs-from-Incapsula-to-S3-Bucket/m-p/392056#M95641 brewster88 2020-09-29T23:18:34Z https://community.splunk.com/t5/Getting-Data-In/Delay-in-logs-from-Incapsula-to-S3-Bucket/m-p/392057#M95642 <P>This is not possible. You will have to build some other process in AWS to add more data and then send that to Splunk, too, and correlate it.</P> Wed, 06 Mar 2019 08:43:56 GMT https://community.splunk.com/t5/Getting-Data-In/Delay-in-logs-from-Incapsula-to-S3-Bucket/m-p/392057#M95642 woodcock 2019-03-06T08:43:56Z