Getting Data In

Is _indextime set at parse time or index time?

Lowell
Super Champion

Does anyone know if the _indextime field is assigned during the parsing phase or when the event is written into the index? I'm assuming that, as a meta field, it is actually created at parsing time, but I'm looking for confirmation.

Specifically, in the case of a UF -> intermediate heavy forwarder -> indexer, I'd like to know if event lag is occurring on the indexer. But I can't determine that if indextime is set during the parsing phase.

0 Karma
1 Solution

s2_splunk
Splunk Employee
Splunk Employee

_indextime is determined in the indexing pipeline processor just before an event is written to disk, so there is little to no chance for lag introduced at that processing phase.

View solution in original post

s2_splunk
Splunk Employee
Splunk Employee

_indextime is determined in the indexing pipeline processor just before an event is written to disk, so there is little to no chance for lag introduced at that processing phase.

View solution in original post

Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.