Getting Data In

Time difference (practical values) between event-time and index-time in large clustered environments

koshyk
Super Champion

I know it is a weird question (like how long piece of string), but this is more of values from your experience/real-time practical value in your large clustred environment. We are estimating for how fast Splunk can respond in real-time, but on analysing difference between _time and _indextime , the values are much higher than I thought. It is coming up in 300seconds for 90th Percentile of data.

  • The data comes from syslog and from Universal Forwarders.
  • No queueing/pipeline blocks
  • No delay from source as such

Just wanted to verify how you guy's systems are looking? is 300 seconds too much or good enough for most of the data?

0 Karma
1 Solution

woodcock
Esteemed Legend

The normal average for file-based forwarding of events is roughly 100 seconds (syslog should be even smaller) for _indextime - _time. Anything bigger than 300 seconds should be investigated, IMHO.

View solution in original post

0 Karma

woodcock
Esteemed Legend

The normal average for file-based forwarding of events is roughly 100 seconds (syslog should be even smaller) for _indextime - _time. Anything bigger than 300 seconds should be investigated, IMHO.

0 Karma

koshyk
Super Champion

thank you mate.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...