https://community.splunk.com/t5/Splunk-Search/How-to-get-index-time-in-subseconds/m-p/189508#M54595 <P>Running your query for my <CODE>_internal</CODE> index does give me subseconds.</P> <P>There's a much greater problem though. Your convert call treats the time difference in <CODE>index_lag</CODE> as a unix time epoch timestamp. As a result, a value of 86400 is treated exactly the same as a value of 0 because you're cutting off the day that would roll over. Similarly, negative values would be ignored.<BR /> It'd be better to use the <CODE>duration</CODE> conversion Splunk offers:</P> <PRE><CODE>index=main | eval index_lag = _indextime - _time | eval converted_index_lag = tostring(index_lag, "duration") </CODE></PRE> <P>That will still provide a wonky handling of negative values, but at least you won't see lags over a day being wrapped to within one day.</P> <P>Both options should show milliseconds though.</P> Wed, 25 Dec 2013 22:34:41 GMT martin_mueller 2013-12-25T22:34:41Z https://community.splunk.com/t5/Splunk-Search/How-to-get-index-time-in-subseconds/m-p/189507#M54594 <P>Hi Splunkers,</P> <P>I want to know the index time lag in subsecond order by following command.</P> <PRE><CODE>index=main | eval index_lag = _indextime - _time | convert timeformat="%H:%M:%S.%3N" ctime(index_lag) </CODE></PRE> <P>But the values of "index_lag" are below.</P> <PRE><CODE>00:00:00.000 00:00:01.000 </CODE></PRE> <P>These results may be wrong in subseconds.<BR /> How to get correct figures ?</P> <P>Thank you.</P> Wed, 25 Dec 2013 06:58:35 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-index-time-in-subseconds/m-p/189507#M54594 sunrise 2013-12-25T06:58:35Z https://community.splunk.com/t5/Splunk-Search/How-to-get-index-time-in-subseconds/m-p/189508#M54595 <P>Running your query for my <CODE>_internal</CODE> index does give me subseconds.</P> <P>There's a much greater problem though. Your convert call treats the time difference in <CODE>index_lag</CODE> as a unix time epoch timestamp. As a result, a value of 86400 is treated exactly the same as a value of 0 because you're cutting off the day that would roll over. Similarly, negative values would be ignored.<BR /> It'd be better to use the <CODE>duration</CODE> conversion Splunk offers:</P> <PRE><CODE>index=main | eval index_lag = _indextime - _time | eval converted_index_lag = tostring(index_lag, "duration") </CODE></PRE> <P>That will still provide a wonky handling of negative values, but at least you won't see lags over a day being wrapped to within one day.</P> <P>Both options should show milliseconds though.</P> Wed, 25 Dec 2013 22:34:41 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-index-time-in-subseconds/m-p/189508#M54595 martin_mueller 2013-12-25T22:34:41Z https://community.splunk.com/t5/Splunk-Search/How-to-get-index-time-in-subseconds/m-p/189509#M54596 <P>Thank you, martin_mueller.</P> Thu, 26 Dec 2013 03:20:29 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-index-time-in-subseconds/m-p/189509#M54596 sunrise 2013-12-26T03:20:29Z