获取splunk的latencytime

想要获取Splunk 的latency time，只需要知道_indextime 和 _time就可以了，latency = _indextime- _time

成都创新互联公司主营德化网站建设的网络公司,主营网站建设方案,app软件定制开发,德化h5小程序设计搭建,德化网站营销推广欢迎德化等地区企业咨询

可以直接用query在Splunk查询：

1.index=app host="****" | eval diff= _indextime - _time| search diff>60| stats count, avg(diff), min(diff), max(diff) by host

2.index=app host="****" | eval diff= _indextime - _time | eval indextime=strftime(_indextime,"%Y-%m-%d %H:%M:%S") |eval capturetime=strftime(_time,"%Y-%m-%d %H:%M:%S") | table indextime capturetime diff