Assuming you're picking up events directly when they're generated and that they have valid timestamps that Splunk identifies and uses, you can check the difference between when events were generated (_time) and when they were actually indexed (_indextime).
... | eval timediff=_indextime-_time
