Getting Data In

Computing latency between event time, arrival, and indexing

droth333
Explorer

I know I can get lag between the timestamp of the event, and its
index time on the indexer by using

|eval lag = _indextime - _index

Is there a value that says when it arrived on the indexer?
That would help me to know whether my indexing latency problem is
at the forwarder, at the indexer, or somewhere else.

I know these magic _* fields aren't documented, but is there such
a field as the above? Like _arrivaltime value...
Thanks.

1 Solution

yannK
Splunk Employee
Splunk Employee

Good question, but there is no such value.

_time is the timestamp extracted from the events.
_indextime is the time when the event was written to the index, not when it was received by the indexer.

View solution in original post

bkumarm
Contributor

Since this question was posted long ago? Just checking any new features added in Splunk that gives the time of arrival of log into the Universal forwarder?

0 Karma

yannK
Splunk Employee
Splunk Employee

Good question, but there is no such value.

_time is the timestamp extracted from the events.
_indextime is the time when the event was written to the index, not when it was received by the indexer.

Get Updates on the Splunk Community!

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Enhance Security Operations with Automated Threat Analysis in the Splunk EcosystemAre you leveraging ...

Splunk Developers: Go Beyond the Dashboard with These .Conf25 Sessions

  Whether you’re building custom apps, diving into SPL2, or integrating AI and machine learning into your ...

Index This | How do you write 23 only using the number 2?

July 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...