Using the following search, I'm seeing AWS CloudTrail ingest lag between 4 and 9 hours.
index=ibp_aws sourcetype=aws:cloudtrail*
| eval lag=round((_indextime - _time)/60,1)
| bin _time span=10m
| stats max(lag) AS xLagH min(lag) AS nLagH count by _indextime
| eval _time=_indextime
| timechart span=10m max(xLagH) min(nLagH) sum(count)
If the search is correct, any idea why AWS CloudTrail ingest would lag
like this? I'm on Splunk Enterprise 7.0.1 and Splunk_TA_aws 4.4.0.
