Time difference (practical values) between event-time and index-time in large clustered environments

[koshyk]

I know it is a weird question (like how long piece of string), but this is more of values from your experience/real-time practical value in your large clustred environment. We are estimating for how fast Splunk can respond in real-time, but on analysing difference between _time and _indextime , the values are much higher than I thought. It is coming up in 300seconds for 90th Percentile of data.

• The data comes from syslog and from Universal Forwarders.
• No queueing/pipeline blocks
• No delay from source as such

Just wanted to verify how you guy's systems are looking? is 300 seconds too much or good enough for most of the data?

[woodcock · Accepted solution]

The normal average for file-based forwarding of events is roughly 100 seconds (syslog should be even smaller) for _indextime - _time. Anything bigger than 300 seconds should be investigated, IMHO.

[koshyk]

thank you mate.