Getting Data In

Is _indextime set at parse time or index time?

Lowell
Super Champion

Does anyone know if the _indextime field is assigned during the parsing phase or when the event is written into the index? I'm assuming that, as a meta field, it is actually created at parsing time, but I'm looking for confirmation.

Specifically, in the case of a UF -> intermediate heavy forwarder -> indexer, I'd like to know if event lag is occurring on the indexer. But I can't determine that if indextime is set during the parsing phase.

0 Karma
1 Solution

s2_splunk
Splunk Employee
Splunk Employee

_indextime is determined in the indexing pipeline processor just before an event is written to disk, so there is little to no chance for lag introduced at that processing phase.

View solution in original post

s2_splunk
Splunk Employee
Splunk Employee

_indextime is determined in the indexing pipeline processor just before an event is written to disk, so there is little to no chance for lag introduced at that processing phase.

Get Updates on the Splunk Community!

OpenTelemetry for Legacy Apps? Yes, You Can!

This article is a follow-up to my previous article posted on the OpenTelemetry Blog, "Your Critical Legacy App ...

UCC Framework: Discover Developer Toolkit for Building Technology Add-ons

The Next-Gen Toolkit for Splunk Technology Add-on Development The Universal Configuration Console (UCC) ...

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...