Getting Data In

How do you verify that multiple indexes are time synced?

Path Finder

We have upwards of 50 different security technologies reporting into Splunk. I'm being tasked with verifying that all the technologies reporting are properly time synced. Without going into each technology individually and verify NTP configurations, is there a way to run a query in Splunk to check time synchronization?

0 Karma


You will need to look at how hosts are logging in your environment and how far off the timestamp of the last event sent by each host is from the current time. Here is a query that will help with that

| metadata type=hosts index=*
| eval time_zone_diff = Now() - lastTime
| eval recent_time = Now() - recentTime
| sort time_diff

Hosts with a negative value for the time_diff field are sending data that is "in the future" compared to the clock of your Splunk Servers. This indicates hosts with a time zone that are ahead of the time zone of your splunk infrastructure. Hosts with a high value for time_diff and a low value for recent_time indicate hosts with a time zone that are behind your Splunk infrastructure.

Here is the metadata doc for reference:
Time zone docs for help with remediation:

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...