https://community.splunk.com/t5/Getting-Data-In/How-to-time-warp-from-a-certain-IP/m-p/601266#M104769 <P>We have a case where -</P> <P>&nbsp;</P> <LI-CODE lang="markup">index = network_index host=xx.xx.xx.xx | eval lag_sec = (_indextime - _time) | stats count by lag_sec</LI-CODE> <P>&nbsp;</P> <P>_time is current but _indextime is 37 minute earlier.&nbsp;</P> <P>What can it be?&nbsp;</P> Fri, 10 Jun 2022 16:45:11 GMT danielbb 2022-06-10T16:45:11Z https://community.splunk.com/t5/Getting-Data-In/How-to-time-warp-from-a-certain-IP/m-p/601266#M104769 <P>We have a case where -</P> <P>&nbsp;</P> <LI-CODE lang="markup">index = network_index host=xx.xx.xx.xx | eval lag_sec = (_indextime - _time) | stats count by lag_sec</LI-CODE> <P>&nbsp;</P> <P>_time is current but _indextime is 37 minute earlier.&nbsp;</P> <P>What can it be?&nbsp;</P> Fri, 10 Jun 2022 16:45:11 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-time-warp-from-a-certain-IP/m-p/601266#M104769 danielbb 2022-06-10T16:45:11Z https://community.splunk.com/t5/Getting-Data-In/How-to-time-warp-from-a-certain-IP/m-p/601269#M104770 <P>If _indextime is earlier than _time it most probably means some misconfiguration in the timezone department. And optionally - if the difference is not in full hours - lack of time sync, choking on reporting somewhere or a source which reads batches of events periodicaly.</P><P>But most probably there is some inconsistency between what source thinks it sends as timestamp and how splunk interprets it.</P><P>Check the raw data and look at the timestamps.</P> Thu, 09 Jun 2022 21:09:21 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-time-warp-from-a-certain-IP/m-p/601269#M104770 PickleRick 2022-06-09T21:09:21Z