Computing latency between event time, arrival, and indexing

[droth333]

I know I can get lag between the timestamp of the event, and its
index time on the indexer by using

|eval lag = _indextime - _index

Is there a value that says when it arrived on the indexer?
That would help me to know whether my indexing latency problem is
at the forwarder, at the indexer, or somewhere else.

I know these magic _* fields aren't documented, but is there such
a field as the above? Like _arrivaltime value...
Thanks.

[bkumarm]

Since this question was posted long ago? Just checking any new features added in Splunk that gives the time of arrival of log into the Universal forwarder?

[yannK · Accepted solution]

Good question, but there is no such value.

_time is the timestamp extracted from the events.
_indextime is the time when the event was written to the index, not when it was received by the indexer.