How can I find out the max indexing delay, maybe by using the tstats command?

[danielbb]

I would like to find out the max indexing delay per index.

| tstats max(_indextime - _time) where index=* by index

Throws the error -
-- Error in 'stats' command: The aggregation specifier 'max(_indextime' is invalid. The aggregation specifier must be in func_name format.

[richgalloway · Accepted solution]

'_indextime - _time` is not a valid expression. You need to extract _indextime and _time separately and then find the difference.

| tstats latest(_time) AS _time latest(_indextime) AS _indextime where index=* by index | eval delta=_indextime - _time | ...

[danielbb]

Useful thing, but does it really give back the max delay per index? or the latest delay per index?

[richgalloway]

It's the latest. Max(_time)==latest(_time). To find the true max would require reading every event in every index and performing stats max(eval(_indextime - _time)) on each. That would be very slow.

This query may help more. It shows the lag time per minute to help you identify when lags are happening.

| tstats latest(_time) AS time latest(_indextime) AS indextime where index=* by index, _time span=1m | eval delta=indextime - time | where delta>0

[danielbb]

That's great @richgalloway