Comparing message time to service receipt time

When creating sources with unknown timestamps and timezones, it is often helpful for troubleshooting to know the difference between the time the service received the message and the actual message time within the log file. The following simple query compares the message time to receipt time, which allows you to immediately see if your messages are coming in late, if Sumo Logic is not properly parsing the timezone from the logs, or if the default timezone is improperly set.

* | formatDate(fromMillis(_receipttime), "MM/dd/yyyy HH:mm:ss:SSS") as receipt

You can further expand this query to give you a count in minutes between the two times, sorted by Collector and Source, to quickly determine which sources may need a configuration update or further review. Only run the following query for the most recent 15 minute time range. Since this will query all log data you have submitted, it will take some time to complete.

* | formatDate(fromMillis(_receipttime), "MM/dd/yyyy HH:mm:ss:SSS") as receipt 
 | _receiptTime - _messageTime as delay 
 | delay / 60000 as delayInMinutes 
 | toInt(delayInMinutes) as delayInMinutes 
 |  avg(delayInMinutes) as avgDelayInMinutes, min(delayInMinutes) as minDelayInMinutes, max(delayInMinutes) as maxDelayInMinutes by _collector, _source, _sourceName