Get the latency time of splunk
To get the latency time of Splunk, all you need to know is _ indextime and _ time, latency = _ indextime- _ time
You can directly use query to query in Splunk:
1.index=app host= "*" | eval diff= _ indextime-_ time | search diff > 60 | stats count, avg (diff), min (diff), max (diff) by host
2.index=app host= "*" | eval diff= _ indextime-_ time | eval indextime=strftime (_ indextime, "% Y-%m-%d% H:%M:%S") | eval capturetime=strftime (_ time, "% Y-%m-%d% H:%M:%S") | table indextime capturetime diff
