获取splunk 的 latency time

可以直接用query在Splunk查询：

1.index=app host="****" | eval diff= _indextime - _time| search diff>60| stats count, avg(diff), min(diff), max(diff) by host

2.index=app host="****" | eval diff= _indextime - _time | eval indextime=strftime(_indextime,"%Y-%m-%d %H:%M:%S") |eval capturetime=strftime(_time,"%Y-%m-%d %H:%M:%S") | table indextime capturetime diff

获取splunk 的 latency time

原文：https://blog.51cto.com/14305934/2397419