In the metrics log there are avg_age and max_age parameters which estimate the age of the data when it comes through a Splunk forwarder - are these values in seconds?
It is sec, but it holds up to six decimal places.
View solution in original post