It would be both useful and interesting to be able to graph the indexing latency for various data sources or hosts over time.
Is there a way to compare "insert time" (for the splunk database) with "event time" (from the source logfile) and build such a set of charts?
Yes, the "insert time" is the
_indextime field and the "event time" is the
You can search:
... | eval lag = _indextime - _time | timechart median(lag) by ...
This is fascinating stuff, but there's a datum missing that would
help me know everything for an indexing latency problem I have:
_time is timestamp on the event
_indextime is time it was indexed at the indexer.
need _arrivaltime, the time it arrive at the indexer.
Is there such a value?
In general where can I find these hidden groovy _* variables listed?