Hello all As a splunk in an early station 😀 I currently have the following challenge: We have many indexes and we want to do an analysis over all indexes how fast the log data is available in Splunk. As distance should be measured from writing the log (_time) to indexing time (_indextime). Also we want to exclude scatter (e.g. we currently have hosts with wrong time configuration, i.e. something like a Gaussian normal distribution). Here is an example query, which is probably wrong or could be done much better by you: | tstats latest(_time) AS logTime latest(_indextime) AS IndexTime WHERE index=bv* BY _time span=1h | eval delta=IndexTime - logTime | search (delta<1800 AND delta>0) | table _time delta Is the query approx correct so that we can answer the question what kind of deley we have over all? How could one use a Gaussian normal distribution instead of restricting the search manually? ... View more