Getting Data In

How do I fix this error: One or more sourcetypes has been found to present events in the future


Hello everyone,

In Splunk GUI when i run health check its showing one error like One or more source types has been found to present events in the future. All the sources are giving the correct timestamp with timezone UTC +0:00 but when i checked the devices that are configured with the source types with the error, the devices are in the other timezone i.e UTC +08:00, and we are receiving the logs that are also in the future timezone. so how can i overcome this problem with the future timestamp. the Splunk indexer time zone is UTC +0:00 please refer the screenshot.


Thanks in advance............

0 Karma


HI @Mohanveera1 

it could be that  the timestamp extraction for this sourcetype in the props.conf might be ignoring the time zone specifier probably you might want to consider using theTimezone(TZ) attribute if the event time stamp does not have  a time zone

would you mind sharing the props configuration for this sourcetype


Note: if it helps karma points are appreciated/if it resolves acceptance of the solution is appreciated 

0 Karma


Hi @venky1544 


Thank you for your response.

The events are having the timestamp and the devices from which the events are generating are in other time zone i.e +08:00 UTC. But the splunk time zone is +0:00 UTC.

I have searched for the props.conf for the specific sourcetype which are getting the future timestamp error. but there was no file available.

the path where is searched for the props.conf is Splunk home/etc/apps/apacinfoblox/local. so please suggest me the way to solve the issue.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...