Getting Data In

Computing latency between event time, arrival, and indexing

droth333
Explorer

I know I can get lag between the timestamp of the event, and its
index time on the indexer by using

|eval lag = _indextime - _index

Is there a value that says when it arrived on the indexer?
That would help me to know whether my indexing latency problem is
at the forwarder, at the indexer, or somewhere else.

I know these magic _* fields aren't documented, but is there such
a field as the above? Like _arrivaltime value...
Thanks.

1 Solution

yannK
Splunk Employee
Splunk Employee

Good question, but there is no such value.

_time is the timestamp extracted from the events.
_indextime is the time when the event was written to the index, not when it was received by the indexer.

View solution in original post

bkumarm
Contributor

Since this question was posted long ago? Just checking any new features added in Splunk that gives the time of arrival of log into the Universal forwarder?

0 Karma

yannK
Splunk Employee
Splunk Employee

Good question, but there is no such value.

_time is the timestamp extracted from the events.
_indextime is the time when the event was written to the index, not when it was received by the indexer.

Get Updates on the Splunk Community!

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...