How do I measure the time taken to forward data from a universal forwarder to an indexer?

[amoldesai]

Hi,

I am using a universal forwarder to forward data to an indexer.

How do I measure the time taken to forward the data to indexer?

Thanks

[Yasaswy]

Hi,
To get the exact time your data is spends on wire between the forwarder and indexer, you will have to check on the network front. But if you are looking to get an estimate of the difference between the time the event gets logged on your forwarder and the time it gets indexed on the indexer, you can get it by:

your search .... host=your_forwarder |eval latency=(_indextime - _time),indextime=strftime(_indextime,"%Y-%m-%d %H:%M:%S")|table _time, indextime, latency

[amoldesai]

Thanks a lot Yasaswy

[piebob]

if this solved your problem, please accept Yasaswy's answer.