How do I check, how long it took for one of the event to appear in splunk?

[msg4sunil]

Hello All,

How do I check, how long it took for one of the event to appear in splunk?

By the way, Solved: How do i find out how long it takes Splunk to actu... - Splunk Community didnt help.

Thank you

[ITWhisperer]

What was it that you would like that isn't covered by using _indextime?

[msg4sunil · Accepted solution]

Never mind. figured out. the below one worked.  thank you

| eval time=_time | eval indextime=_indextime | eval diff=time-indextime | where diff>=0 | convert ctime(indextime) | convert ctime(time) | table time indextime diff