ingestion_time

Use ingestion_time to identify delays between when an HTTP request occurred and when it was ingested into Axiom.

Query

['sample-http-logs']
| extend ingest_time = ingestion_time()
| extend delay = datetime_diff('second', ingest_time, _time)
| where delay > 1
| project _time, ingest_time, delay, method, uri, status

Output

This query calculates the difference between the ingestion time and event time, highlighting entries with more than 60 seconds delay.

Use ingestion_time to monitor ingestion lags for spans generated by services, helping identify pipeline slowdowns or delivery issues.

Query

['otel-demo-traces']
| extend ingest_time = ingestion_time()
| extend delay = datetime_diff('second', ingest_time, _time)
| summarize avg_delay = avg(delay) by ['service.name'], kind
| order by avg_delay desc

Output

This query calculates the average ingestion delay per service and kind to identify services affected by delayed ingestion.

Use ingestion_time to identify recently ingested suspicious activity, even if the event occurred earlier.

Query

['sample-http-logs']
| extend ingest_time = ingestion_time()
| where status == '401' and ingest_time > ago(1h)
| project _time, ingest_time, id, method, uri, ['geo.country']

Output

This query surfaces failed login attempts that were ingested in the last hour, regardless of when the request actually occurred.