https://community.splunk.com/t5/Deployment-Architecture/How-do-we-handle-servers-with-untuned-NTP-service/m-p/409668#M14708 <P>Makes perfect sense @kmorris_splunk - thank you!</P> Thu, 06 Jun 2019 20:21:42 GMT ddrillic 2019-06-06T20:21:42Z https://community.splunk.com/t5/Deployment-Architecture/How-do-we-handle-servers-with-untuned-NTP-service/m-p/409666#M14706 <P>We occasionally come across servers with universal forwarders or devices that send syslog and their NTP service is off, which obviously causes some incorrect times to flow into Splunk.</P> <P>How are other teams deal with it, detecting the issue? fixing, etc.</P> <P>A handy definition of NTP ; -)</P> <P>-- The Network Time Protocol (NTP) is a networking protocol for clock synchronization between computer systems over packet-switched, variable-latency data networks. In operation since before 1985, NTP is one of the oldest Internet protocols in current use. NTP was designed by David L. Mills of the University of Delaware</P> Wed, 10 Jun 2020 19:34:21 GMT https://community.splunk.com/t5/Deployment-Architecture/How-do-we-handle-servers-with-untuned-NTP-service/m-p/409666#M14706 ddrillic 2020-06-10T19:34:21Z https://community.splunk.com/t5/Deployment-Architecture/How-do-we-handle-servers-with-untuned-NTP-service/m-p/409667#M14707 <P>You could check out this NTPDrifter app to help identify the problem servers. </P> <P><A href="https://splunkbase.splunk.com/app/1292/">https://splunkbase.splunk.com/app/1292/</A></P> <P>As for fixing the issue, I believe the best way is to correct the NTP problem at the source. Trying to manipulate your searches to account for it would really just be a band-aid and not even sure there would be a good way to do it.</P> Thu, 06 Jun 2019 17:49:16 GMT https://community.splunk.com/t5/Deployment-Architecture/How-do-we-handle-servers-with-untuned-NTP-service/m-p/409667#M14707 kmorris_splunk 2019-06-06T17:49:16Z https://community.splunk.com/t5/Deployment-Architecture/How-do-we-handle-servers-with-untuned-NTP-service/m-p/409668#M14708 <P>Makes perfect sense @kmorris_splunk - thank you!</P> Thu, 06 Jun 2019 20:21:42 GMT https://community.splunk.com/t5/Deployment-Architecture/How-do-we-handle-servers-with-untuned-NTP-service/m-p/409668#M14708 ddrillic 2019-06-06T20:21:42Z https://community.splunk.com/t5/Deployment-Architecture/How-do-we-handle-servers-with-untuned-NTP-service/m-p/409669#M14709 <P>Does it require a Splunk restart after NTP settings on the server is changed, if the server is a Heavy Forwarder ?</P> Fri, 22 May 2020 01:14:58 GMT https://community.splunk.com/t5/Deployment-Architecture/How-do-we-handle-servers-with-untuned-NTP-service/m-p/409669#M14709 damode 2020-05-22T01:14:58Z