https://community.splunk.com/t5/Getting-Data-In/Splunk-Indexing-Question/m-p/572733#M101347 <P>I can't see your screenshot clearly (the left half of it is completely unnecessary ;)) but in general "in &lt;time spec&gt;" means a timestamp in the future. So you probably have some misconfiguration and some events are either sent with a timestamp from the future or are getting parsed as such. Typical scenario - timezone mismatch between the sender and sourcetype config.</P> Wed, 27 Oct 2021 19:24:12 GMT PickleRick 2021-10-27T19:24:12Z https://community.splunk.com/t5/Getting-Data-In/Splunk-Indexing-Question/m-p/572732#M101346 <P>My index shows the latest event section "in an hour", I have never seen that before. What exactly does that mean?<span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Screenshot (51).png" style="width: 999px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/16619i5C8FE7BFA7471EAC/image-size/large?v=v2&amp;px=999" role="button" title="Screenshot (51).png" alt="Screenshot (51).png" /></span></P> Wed, 27 Oct 2021 19:20:13 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-Indexing-Question/m-p/572732#M101346 andrew_burnett 2021-10-27T19:20:13Z https://community.splunk.com/t5/Getting-Data-In/Splunk-Indexing-Question/m-p/572733#M101347 <P>I can't see your screenshot clearly (the left half of it is completely unnecessary ;)) but in general "in &lt;time spec&gt;" means a timestamp in the future. So you probably have some misconfiguration and some events are either sent with a timestamp from the future or are getting parsed as such. Typical scenario - timezone mismatch between the sender and sourcetype config.</P> Wed, 27 Oct 2021 19:24:12 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-Indexing-Question/m-p/572733#M101347 PickleRick 2021-10-27T19:24:12Z