Though there is no specific answers discussed, the solution I found is to use the _indexingtime . As for now there is nothing called time of arrival in Splunk . Frankly this should be recorded, so we will have the delay factor accounted for. So time of event generation, time of arrival at Splunk and Indexing time should be used to analyze the delay introduced overall.
I am not perfect ..so if you have any other solution please suggest ... open to ideas !!!
... View more