Getting Data In

Time difference (practical values) between event-time and index-time in large clustered environments

Super Champion

I know it is a weird question (like how long piece of string), but this is more of values from your experience/real-time practical value in your large clustred environment. We are estimating for how fast Splunk can respond in real-time, but on analysing difference between _time and _indextime , the values are much higher than I thought. It is coming up in 300seconds for 90th Percentile of data.

  • The data comes from syslog and from Universal Forwarders.
  • No queueing/pipeline blocks
  • No delay from source as such

Just wanted to verify how you guy's systems are looking? is 300 seconds too much or good enough for most of the data?

0 Karma
1 Solution

Esteemed Legend

The normal average for file-based forwarding of events is roughly 100 seconds (syslog should be even smaller) for _indextime - _time. Anything bigger than 300 seconds should be investigated, IMHO.

View solution in original post

0 Karma

Esteemed Legend

The normal average for file-based forwarding of events is roughly 100 seconds (syslog should be even smaller) for _indextime - _time. Anything bigger than 300 seconds should be investigated, IMHO.

View solution in original post

0 Karma

Super Champion

thank you mate.

0 Karma