Delay in logs from Incapsula to S3 Bucket

[brewster88]

Morning Guys,

We are currently having an issue with our Incapsula WAF sending logs to our AWS s3 Bucket with a delay and hoping to use a query within Splunk to provide evidence of these delays.

So far I have got as far as the following:

index=incapsula | eval delay_sec=_indextime-_time | convert ctime(_indextime) AS indextime | eval now=now() | table _time indextime now date_zone source sourcetype host

This gives a table similar to what I am after, however Im looking for the actual time stamps (epoch) on the events as they happened and the actual time the log file arrived in the s3 bucket rather than the time the log file arrived at the index, any thoughts on how to modify this query to get the necessary information at all?

Cheers guys

[woodcock · Accepted solution]

This is not possible. You will have to build some other process in AWS to add more data and then send that to Splunk, too, and correlate it.