Hi all,I am pulling events in alerts and seeing a gap between _time and _indextime. Around 535 seconds average difference. I have 2 questions1) What is the best practice approach to match these field values to each other? So have the results of
_time = _indextime
2) Is this time delay a sign of other things to investigate in the pipeline? Per this post https://community.splunk.com/t5/Getting-Data-In/Time-difference-practical-values-between-event-time-...this is a rather significant time difference.
Here are a few things to check: