Indexing Latency Chart

[rotten]

It would be both useful and interesting to be able to graph the indexing latency for various data sources or hosts over time.

Is there a way to compare "insert time" (for the splunk database) with "event time" (from the source logfile) and build such a set of charts?

[Stephen_Sorkin]

Yes, the "insert time" is the _indextime field and the "event time" is the _time field.

You can search:

... | eval lag = _indextime - _time | timechart median(lag) by ...

[droth333]

This is fascinating stuff, but there's a datum missing that would
help me know everything for an indexing latency problem I have:
_time is timestamp on the event
_indextime is time it was indexed at the indexer.
need _arrivaltime, the time it arrive at the indexer.
Is there such a value?

In general where can I find these hidden groovy _* variables listed?
Thanks,
Dave

[Lowell]

Version note: Keep in mind that the _indextime field was added in version 4.0. With earlier versions you cannot track indexing latency like this.