Monitoring Splunk
Highlighted

Indexed information audit trail

Engager

Hi,

Does Splunk audit the trail that an information coming from a source-type is passing?
Can I query to know timestamps of when the information got to forwarders, indexers?
Can determine where the information was passing through, to the level of the hosting machine?

Even if Splunk does not do this for every piece of information, and I need to mark specific information somehow in order for me to later measure the above mentioned - it is enough.

thanks,
Adi

Tags (3)
0 Karma
Highlighted

Re: Indexed information audit trail

Splunk Employee
Splunk Employee

Splunk only records the time that an event was stored and index on the indexer. It does not record when the forwarder picked it up or passed it along. Of course, it also extract the time embedded within the event as the event timestamp.

Highlighted

Re: Indexed information audit trail

Engager

Thank you gkanapathy. Can you tell me please where can I get the information of store and index time of an event in the Indexer?

Adi

0 Karma
Highlighted

Re: Indexed information audit trail

Engager

Also, can you tell me what time zone is used for these timestamping? - thanks!

0 Karma