I know I can get lag between the timestamp of the event, and its
index time on the indexer by using
|eval lag = _indextime - _index
Is there a value that says when it arrived on the indexer?
That would help me to know whether my indexing latency problem is
at the forwarder, at the indexer, or somewhere else.
I know these magic _* fields aren't documented, but is there such
a field as the above? Like _arrivaltime value...
Thanks.
Good question, but there is no such value.
_time is the timestamp extracted from the events.
_indextime is the time when the event was written to the index, not when it was received by the indexer.
Since this question was posted long ago? Just checking any new features added in Splunk that gives the time of arrival of log into the Universal forwarder?
Good question, but there is no such value.
_time is the timestamp extracted from the events.
_indextime is the time when the event was written to the index, not when it was received by the indexer.