https://community.splunk.com/t5/Monitoring-Splunk/how-to-track-lag-between-log-timestamp-and-time-arrive-in-Splunk/m-p/340774#M5271 <P>hello leonjxtan<BR /> the field you are looking for is _indextime<BR /> latency is _indextime -_time <BR /> here is a full answer from this portal: <A href="https://answers.splunk.com/answers/11870/how-can-i-view-the-indexing-latency-for-incoming-events-in-real-time.html" target="_blank">https://answers.splunk.com/answers/11870/how-can-i-view-the-indexing-latency-for-incoming-events-in-real-time.html</A><BR /> it explains it in detail and provides some examples as well<BR /> hope it helps</P> Tue, 29 Sep 2020 13:45:56 GMT adonio 2020-09-29T13:45:56Z https://community.splunk.com/t5/Monitoring-Splunk/how-to-track-lag-between-log-timestamp-and-time-arrive-in-Splunk/m-p/340773#M5270 <P>Wanted to track lag between log generated in host server and time arrive in Splunk.<BR /> Any search can achieve that?</P> Fri, 21 Apr 2017 03:48:17 GMT https://community.splunk.com/t5/Monitoring-Splunk/how-to-track-lag-between-log-timestamp-and-time-arrive-in-Splunk/m-p/340773#M5270 leonjxtan 2017-04-21T03:48:17Z https://community.splunk.com/t5/Monitoring-Splunk/how-to-track-lag-between-log-timestamp-and-time-arrive-in-Splunk/m-p/340774#M5271 <P>hello leonjxtan<BR /> the field you are looking for is _indextime<BR /> latency is _indextime -_time <BR /> here is a full answer from this portal: <A href="https://answers.splunk.com/answers/11870/how-can-i-view-the-indexing-latency-for-incoming-events-in-real-time.html" target="_blank">https://answers.splunk.com/answers/11870/how-can-i-view-the-indexing-latency-for-incoming-events-in-real-time.html</A><BR /> it explains it in detail and provides some examples as well<BR /> hope it helps</P> Tue, 29 Sep 2020 13:45:56 GMT https://community.splunk.com/t5/Monitoring-Splunk/how-to-track-lag-between-log-timestamp-and-time-arrive-in-Splunk/m-p/340774#M5271 adonio 2020-09-29T13:45:56Z