Getting Data In

How can I find out the max indexing delay, maybe by using the tstats command?

danielbb
Motivator

I would like to find out the max indexing delay per index.

| tstats max(_indextime - _time) where index=* by index

Throws the error -
-- Error in 'stats' command: The aggregation specifier 'max(_indextime' is invalid. The aggregation specifier must be in func_name format.

Tags (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

'_indextime - _time` is not a valid expression. You need to extract _indextime and _time separately and then find the difference.

| tstats latest(_time) AS _time latest(_indextime) AS _indextime where index=* by index | eval delta=_indextime - _time | ...
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

'_indextime - _time` is not a valid expression. You need to extract _indextime and _time separately and then find the difference.

| tstats latest(_time) AS _time latest(_indextime) AS _indextime where index=* by index | eval delta=_indextime - _time | ...
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

danielbb
Motivator

Useful thing, but does it really give back the max delay per index? or the latest delay per index?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It's the latest. Max(_time)==latest(_time). To find the true max would require reading every event in every index and performing stats max(eval(_indextime - _time)) on each. That would be very slow.

This query may help more. It shows the lag time per minute to help you identify when lags are happening.

| tstats latest(_time) AS time latest(_indextime) AS indextime where index=* by index, _time span=1m | eval delta=indextime - time | where delta>0
---
If this reply helps you, an upvote would be appreciated.

danielbb
Motivator

That's great @richgalloway

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!