Event delay for host if((round(relative_time(now(), $time.latest$)-relative_time(now(), $time.earliest$))/$time_resolution$)<1,1,round((relative_time(now(), $time.latest$)-relative_time(now(), $time.earliest$))/$time_resolution$)) | makeresults if((round(relative_time(now(), $time.latest$)-relative_time(now(), $time.earliest$))/$time_resolution$)<1,1,round((relative_time(now(), $time.latest$)-relative_time(now(), $time.earliest$))/$time_resolution$)) | tstats count where index=_internal host=$selected_host$ | where count!=0 $time.earliest$ $time.latest$ $result.count$ | tstats count where index=_introspection component::Hostwide host=$selected_host$ | where count!=0 $time.earliest$ $time.latest$ $result.count$ | tstats count where index=_introspection component::hec* host=$selected_host$ | where count!=0 $time.earliest$ $time.latest$ $result.count$ | tstats max(_indextime) AS indexed_time count where host=$selected_host$ (index=* OR index=_*) latest=now earliest=$time.earliest$ _index_latest=$time.latest$ _index_earliest=$time.earliest$ by index host sourcetype splunk_server _time span=$seconds_for_bin$ | eval _time=round(_time), bin_delay=indexed_time-_time | bin span=2log5 bin_delay $time.earliest$ $time.latest$

Select time range -24h@h now if((round(relative_time(now(), $time.latest$)-relative_time(now(), $time.earliest$))/$time_resolution$)<1,1,round((relative_time(now(), $time.latest$)-relative_time(now(), $time.earliest$))/$time_resolution$)) Selected Host Filter indexes All ( ) index=" " OR | stats count by index | eval label=index." (".count.")" * index index Chart resolution Crude Low Medium High Ultra 500

Please enter value for host

Event metadata for $selected_host$

Hyperlink to _introspection metrics

Hyperlink to _internal logs

Show HEC metrics

| search $index_filter$ | timechart limit=0 span=$seconds_for_bin$sec sum(count) by index $start$ $end$ collapsed No of events generated by host linear area stacked top 591 progressbar | search $index_filter$ | eval _time=indexed_time | timechart limit=0 span=$seconds_for_bin$sec sum(count) by index $start$ $end$ Received time collapsed No of events received by Splunk linear area none stacked top 590 progressbar | search $index_filter$ | eval bin_delay=if(bin_delay<0, "future", bin_delay) | timechart limit=0 span=$seconds_for_bin$sec sum(count) by bin_delay $start$ $end$ collapsed Count of events generated by host visible linear area none stacked top 530 progressbar | search $index_filter$ | eval _time=indexed_time | eval bin_delay=if(bin_delay<0, "future", bin_delay) | timechart limit=0 span=$seconds_for_bin$sec sum(count) by bin_delay $start$ $end$ collapsed Count of events received by Splunk visible linear area none stacked top 529 progressbar | search $index_filter$ | timechart limit=0 span=$seconds_for_bin$sec sum(count) by sourcetype area stacked top 489 progressbar | search $index_filter$ | eval _time=indexed_time | eval bin_delay=if(bin_delay<0, "future", bin_delay) | timechart limit=0 span=$seconds_for_bin$sec sum(count) by sourcetype area stacked top 487 progressbar | search $index_filter$ | eval _time=indexed_time | timechart limit=0 span=$seconds_for_bin$sec sum(count) by splunk_server $start$ $end$ linear column gaps none stacked top 617 progressbar some notes