Getting Data In

Time difference (practical values) between event-time and index-time in large clustered environments

koshyk
Super Champion

I know it is a weird question (like how long piece of string), but this is more of values from your experience/real-time practical value in your large clustred environment. We are estimating for how fast Splunk can respond in real-time, but on analysing difference between _time and _indextime , the values are much higher than I thought. It is coming up in 300seconds for 90th Percentile of data.

  • The data comes from syslog and from Universal Forwarders.
  • No queueing/pipeline blocks
  • No delay from source as such

Just wanted to verify how you guy's systems are looking? is 300 seconds too much or good enough for most of the data?

0 Karma
1 Solution

woodcock
Esteemed Legend

The normal average for file-based forwarding of events is roughly 100 seconds (syslog should be even smaller) for _indextime - _time. Anything bigger than 300 seconds should be investigated, IMHO.

View solution in original post

0 Karma

woodcock
Esteemed Legend

The normal average for file-based forwarding of events is roughly 100 seconds (syslog should be even smaller) for _indextime - _time. Anything bigger than 300 seconds should be investigated, IMHO.

0 Karma

koshyk
Super Champion

thank you mate.

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>