- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Is there a method to get the time of arrival of a packet into the universal forwarder, so that I can compute the time difference between TA and Indextime?
what is the standard time delay in indexing? our testing team are saying that splunk is introducing delay.
I want to prove them wrong. Any other ideas?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Though there is no specific answers discussed, the solution I found is to use the _indexingtime . As for now there is nothing called time of arrival in Splunk . Frankly this should be recorded, so we will have the delay factor accounted for. So time of event generation, time of arrival at Splunk and Indexing time should be used to analyze the delay introduced overall.
I am not perfect ..so if you have any other solution please suggest ... open to ideas !!!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Though there is no specific answers discussed, the solution I found is to use the _indexingtime . As for now there is nothing called time of arrival in Splunk . Frankly this should be recorded, so we will have the delay factor accounted for. So time of event generation, time of arrival at Splunk and Indexing time should be used to analyze the delay introduced overall.
I am not perfect ..so if you have any other solution please suggest ... open to ideas !!!
