- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Question on matching event time and index time

dannyze
Explorer
07-27-2020
10:18 AM
Hi all,
I am pulling events in alerts and seeing a gap between _time and _indextime. Around 535 seconds average difference. I have 2 questions
1) What is the best practice approach to match these field values to each other? So have the results of
_time = _indextime
2) Is this time delay a sign of other things to investigate in the pipeline?
Per this post https://community.splunk.com/t5/Getting-Data-In/Time-difference-practical-values-between-event-time-...
this is a rather significant time difference.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

richgalloway

SplunkTrust
07-27-2020
10:34 AM
Here are a few things to check:
- Make sure all systems are running NTP (or equivalent)
- Verify time zones are set correctly on all systems.
- Check the indexer pipelines queues for backlogs.
- Verify the storage system is providing the expected IOPS.
- Check for any intermediate servers (proxy, forwarder, etc) that may be slowing things down.
- Make sure the data source is not caching events before releasing them to Splunk.
---
If this reply helps you, Karma would be appreciated.
If this reply helps you, Karma would be appreciated.
