Monitoring Splunk

Indexed information audit trail

adishilo
Engager

Hi,

Does Splunk audit the trail that an information coming from a source-type is passing?
Can I query to know timestamps of when the information got to forwarders, indexers?
Can determine where the information was passing through, to the level of the hosting machine?

Even if Splunk does not do this for every piece of information, and I need to mark specific information somehow in order for me to later measure the above mentioned - it is enough.

thanks,
Adi

Tags (3)
0 Karma

gkanapathy
Splunk Employee
Splunk Employee

Splunk only records the time that an event was stored and index on the indexer. It does not record when the forwarder picked it up or passed it along. Of course, it also extract the time embedded within the event as the event timestamp.

adishilo
Engager

Also, can you tell me what time zone is used for these timestamping? - thanks!

0 Karma

adishilo
Engager

Thank you gkanapathy. Can you tell me please where can I get the information of store and index time of an event in the Indexer?

Adi

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>