Shulou(Shulou.com)06/03 Report--

To get the latency time of Splunk, all you need to know is _ indextime and _ time, latency = _ indextime- _ time

You can directly use query to query in Splunk:

1.index=app host= "*" | eval diff= _ indextime-_ time | search diff > 60 | stats count, avg (diff), min (diff), max (diff) by host

2.index=app host= "*" | eval diff= _ indextime-_ time | eval indextime=strftime (_ indextime, "% Y-%m-%d% H:%M:%S") | eval capturetime=strftime (_ time, "% Y-%m-%d% H:%M:%S") | table indextime capturetime diff

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.