https://community.splunk.com/t5/Getting-Data-In/Negative-Index-Delay/m-p/237459#M46121 <P>That's not too hard.. _time is derived from the timestamp, which could be in the past or in the future(!). _indextime is the time the event arrives at the indexer.</P> Sat, 08 Oct 2016 15:58:36 GMT gwobben 2016-10-08T15:58:36Z https://community.splunk.com/t5/Getting-Data-In/Negative-Index-Delay/m-p/237458#M46120 <P>Well this one is interesting. How can splunk index something before it knows about it <span class="lia-unicode-emoji" title=":face_with_tongue:">😛</span></P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/1981i6ABC40411386F4AB/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Sat, 08 Oct 2016 15:38:23 GMT https://community.splunk.com/t5/Getting-Data-In/Negative-Index-Delay/m-p/237458#M46120 paimonsoror 2016-10-08T15:38:23Z https://community.splunk.com/t5/Getting-Data-In/Negative-Index-Delay/m-p/237459#M46121 <P>That's not too hard.. _time is derived from the timestamp, which could be in the past or in the future(!). _indextime is the time the event arrives at the indexer.</P> Sat, 08 Oct 2016 15:58:36 GMT https://community.splunk.com/t5/Getting-Data-In/Negative-Index-Delay/m-p/237459#M46121 gwobben 2016-10-08T15:58:36Z https://community.splunk.com/t5/Getting-Data-In/Negative-Index-Delay/m-p/237460#M46122 <P>Makes sense, sounds like i need to be looking at what the _time data is for the events that are coming in.</P> Sat, 08 Oct 2016 16:47:52 GMT https://community.splunk.com/t5/Getting-Data-In/Negative-Index-Delay/m-p/237460#M46122 paimonsoror 2016-10-08T16:47:52Z