Splunk Cloud Platform

Question on matching event time and index time

dannyze
Explorer

Hi all,
I am pulling events in alerts and seeing a gap between _time and _indextime. Around 535 seconds average difference. I have 2 questions
1) What is the best practice approach to match these field values to each other? So have the results of 

 

_time = _indextime 

 


2) Is this time delay a sign of other things to investigate in the pipeline? 
 Per this post https://community.splunk.com/t5/Getting-Data-In/Time-difference-practical-values-between-event-time-...
this is a rather significant time difference. 

Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Here are a few things to check:

  1. Make sure all systems are running NTP (or equivalent)
  2. Verify time zones are set correctly on all systems.
  3. Check the indexer pipelines queues for backlogs.
  4. Verify the storage system is providing the expected IOPS.
  5. Check for any intermediate servers (proxy, forwarder, etc) that may be slowing things down.
  6. Make sure the data source is not caching events before releasing them to Splunk.
---
If this reply helps you, an upvote would be appreciated.
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!