Indexed information audit trail

[adishilo]

Hi,

Does Splunk audit the trail that an information coming from a source-type is passing?
Can I query to know timestamps of when the information got to forwarders, indexers?
Can determine where the information was passing through, to the level of the hosting machine?

Even if Splunk does not do this for every piece of information, and I need to mark specific information somehow in order for me to later measure the above mentioned - it is enough.

thanks,
Adi

[gkanapathy]

Splunk only records the time that an event was stored and index on the indexer. It does not record when the forwarder picked it up or passed it along. Of course, it also extract the time embedded within the event as the event timestamp.

[adishilo]

Also, can you tell me what time zone is used for these timestamping? - thanks!

[adishilo]

Thank you gkanapathy. Can you tell me please where can I get the information of store and index time of an event in the Indexer?

Adi