topic Re: How did logs from a heavy forwarder get indexed when Splunk was not running? in Getting Data In https://community.splunk.com/t5/Getting-Data-In/How-did-logs-from-a-heavy-forwarder-get-indexed-when-Splunk-was/m-p/273329#M52458 <P>Open the events of the log and check if are there events from 23:00</P> <P>Hope i help you</P> Mon, 04 Apr 2016 09:43:40 GMT jmallorquin 2016-04-04T09:43:40Z How did logs from a heavy forwarder get indexed when Splunk was not running? https://community.splunk.com/t5/Getting-Data-In/How-did-logs-from-a-heavy-forwarder-get-indexed-when-Splunk-was/m-p/273326#M52455 <P>Splunk was running on a heavy forwarder during the time period 00:00 to 00:20. Related logs also have been found in splunkd.log &amp; splunkd_stderr.log.<BR /> I got few logs from the HF at 23:00. How is it possible?<BR /> If Splunk is not running, how did these logs get indexed?</P> Mon, 04 Apr 2016 05:06:20 GMT https://community.splunk.com/t5/Getting-Data-In/How-did-logs-from-a-heavy-forwarder-get-indexed-when-Splunk-was/m-p/273326#M52455 Madhan45 2016-04-04T05:06:20Z Re: How did logs from a heavy forwarder get indexed when Splunk was not running? https://community.splunk.com/t5/Getting-Data-In/How-did-logs-from-a-heavy-forwarder-get-indexed-when-Splunk-was/m-p/273327#M52456 <P>Hi,</P> <P>If the logs has timestamp, splunk index in the timestamp of the log. So if the log was create at 23:00, its normal that you have events in that time. Also review the timezone in which you are index the events.</P> <P>Hope i help you.</P> Mon, 04 Apr 2016 09:17:10 GMT https://community.splunk.com/t5/Getting-Data-In/How-did-logs-from-a-heavy-forwarder-get-indexed-when-Splunk-was/m-p/273327#M52456 jmallorquin 2016-04-04T09:17:10Z Re: How did logs from a heavy forwarder get indexed when Splunk was not running? https://community.splunk.com/t5/Getting-Data-In/How-did-logs-from-a-heavy-forwarder-get-indexed-when-Splunk-was/m-p/273328#M52457 <P>The event generated time and index time both are same. there was no lagging in event. splunk was running only for the time period 00:00 00:20 after thet till now i didn't start splunk. then how did those logs get index?</P> Mon, 04 Apr 2016 09:41:32 GMT https://community.splunk.com/t5/Getting-Data-In/How-did-logs-from-a-heavy-forwarder-get-indexed-when-Splunk-was/m-p/273328#M52457 Madhan45 2016-04-04T09:41:32Z Re: How did logs from a heavy forwarder get indexed when Splunk was not running? https://community.splunk.com/t5/Getting-Data-In/How-did-logs-from-a-heavy-forwarder-get-indexed-when-Splunk-was/m-p/273329#M52458 <P>Open the events of the log and check if are there events from 23:00</P> <P>Hope i help you</P> Mon, 04 Apr 2016 09:43:40 GMT https://community.splunk.com/t5/Getting-Data-In/How-did-logs-from-a-heavy-forwarder-get-indexed-when-Splunk-was/m-p/273329#M52458 jmallorquin 2016-04-04T09:43:40Z