Splunk Search

How to get index time in subseconds ?

sunrise
Contributor

Hi Splunkers,

I want to know the index time lag in subsecond order by following command.

index=main | eval index_lag = _indextime - _time | convert  timeformat="%H:%M:%S.%3N" ctime(index_lag)

But the values of "index_lag" are below.

00:00:00.000
00:00:01.000

These results may be wrong in subseconds.
How to get correct figures ?

Thank you.

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Running your query for my _internal index does give me subseconds.

There's a much greater problem though. Your convert call treats the time difference in index_lag as a unix time epoch timestamp. As a result, a value of 86400 is treated exactly the same as a value of 0 because you're cutting off the day that would roll over. Similarly, negative values would be ignored.
It'd be better to use the duration conversion Splunk offers:

index=main | eval index_lag = _indextime - _time | eval converted_index_lag = tostring(index_lag, "duration")

That will still provide a wonky handling of negative values, but at least you won't see lags over a day being wrapped to within one day.

Both options should show milliseconds though.

View solution in original post

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Running your query for my _internal index does give me subseconds.

There's a much greater problem though. Your convert call treats the time difference in index_lag as a unix time epoch timestamp. As a result, a value of 86400 is treated exactly the same as a value of 0 because you're cutting off the day that would roll over. Similarly, negative values would be ignored.
It'd be better to use the duration conversion Splunk offers:

index=main | eval index_lag = _indextime - _time | eval converted_index_lag = tostring(index_lag, "duration")

That will still provide a wonky handling of negative values, but at least you won't see lags over a day being wrapped to within one day.

Both options should show milliseconds though.

0 Karma

sunrise
Contributor

Thank you, martin_mueller.

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...