https://community.splunk.com/t5/Getting-Data-In/How-to-correct-the-future-time-stamp-issue-occurring-for-certain/m-p/357405#M65269 <P>@Hemnaath</P> <P>[Script:ListeningPorts]<BR /> TZ=US/Eastern (which ever timezone you want)</P> Mon, 25 Sep 2017 20:35:09 GMT sbbadri 2017-09-25T20:35:09Z https://community.splunk.com/t5/Getting-Data-In/How-to-correct-the-future-time-stamp-issue-occurring-for-certain/m-p/357404#M65268 <P>Hi All, Currently we are facing an issue with data being logged with future time stamp for certain host and source type.<BR /><BR /> In our environment we have nearly 1000 windows UF agent installed to pull the data from the remote windows machine and it is parsed into 5 indexer instance to index the data from remote devices.</P> <P>Out of 1000 Windows UF agent there are nearly 200 windows agents are logging with future time stamp with the source type = Script:ListeningPorts. </P> <P>I have used the below query to identify the list of any log sources that are logging with future time stamps</P> <P>I have used to this query to verify whether the host and source type are logging with future time stamp or not. </P> <P>index=win_svrs host=test1 sourcetype=Script:ListeningPorts earliest=+5m latest=+20y <BR /> | where _indextime &lt; _time<BR /> | eval indextime=strftime(_indextime, "%+")</P> <P>Below is the partial configuration details : </P> <P>My input stanza configured in all remote windows machine via Deployment server.</P> <P>Scripted Input (See also wmi.conf)<BR /> [script://.\bin\win_listening_ports.bat]<BR /> disabled = 0</P> <H2>Run once per hour</H2> <P>interval = 3600<BR /> sourcetype = Script:ListeningPorts<BR /> index = win_svrs</P> <P>Props.conf <BR /> [source::...win_listening_ports.bat]<BR /> sourcetype = Script:ListeningPorts</P> <P>Data are parsed into all the indexer instance before indexing data into index.</P> <P>Props.conf </P> <P>Listening Ports<BR /> [Script:ListeningPorts]<BR /> SHOULD_LINEMERGE = false</P> <P>Transforms.conf</P> <P>Listening Ports<BR /> [dest_ip_for_listeningports]<BR /> REGEX = dest_ip=[(\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})<BR /> FORMAT = dest_ip::$1</P> <P>[kv_for_listeningports]<BR /> DELIMS = " ", "="</P> <P>I am not sure how its working for other 800 servers with the correct time stamp with the same sourcetype and only for 200 servers we could see future time stamp. </P> <P>Kindly guide me know how to correct the future time stamp issue for 200 servers. </P> Tue, 29 Sep 2020 15:56:35 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-correct-the-future-time-stamp-issue-occurring-for-certain/m-p/357404#M65268 Hemnaath 2020-09-29T15:56:35Z https://community.splunk.com/t5/Getting-Data-In/How-to-correct-the-future-time-stamp-issue-occurring-for-certain/m-p/357405#M65269 <P>@Hemnaath</P> <P>[Script:ListeningPorts]<BR /> TZ=US/Eastern (which ever timezone you want)</P> Mon, 25 Sep 2017 20:35:09 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-correct-the-future-time-stamp-issue-occurring-for-certain/m-p/357405#M65269 sbbadri 2017-09-25T20:35:09Z