想要獲取Splunk 的latency time，只需要知道_indextime 和 _time就可以了，latency = _indextime- _time

成都創(chuàng)新互聯(lián)公司主營德化網(wǎng)站建設(shè)的網(wǎng)絡(luò)公司,主營網(wǎng)站建設(shè)方案,app軟件定制開發(fā),德化h5小程序設(shè)計搭建,德化網(wǎng)站營銷推廣歡迎德化等地區(qū)企業(yè)咨詢

可以直接用query在Splunk查詢：

1.index=app host="****" | eval diff= _indextime - _time| search diff>60| stats count, avg(diff), min(diff), max(diff) by host

2.index=app host="****" | eval diff= _indextime - _time | eval indextime=strftime(_indextime,"%Y-%m-%d %H:%M:%S") |eval capturetime=strftime(_time,"%Y-%m-%d %H:%M:%S") | table indextime capturetime diff