Search to see which forwarders reported in the previous 24 hours or if there is a delay in logs?

[kteng2024]

Hi there,

is there any query to find out the forwarders which are reporting for last 1 day or f there is a delay in the logs.

Thanks

[rphillips_splk]

You can use this search to measure latency in the events which is the difference between when the application wrote the log event timestamp and the time the event was indexed. You can scope the index , host, source etc... if you are interested in the latency from a particular source

index=main | eval delay=_indextime-_time | stats min(delay) avg(delay) max(delay) by host sourcetype source

[somesoni2]

See this:

https://answers.splunk.com/answers/173520/what-search-query-can-i-use-on-my-search-head-to-l.html

[lfedak_splunk]

Hey @kteng2024! Don't forget to "accept" answers when someone answers your question. It helps make the answers more useful to others and awards karma points to the people who are helping you out. 🙂