How to time warp from a certain IP?

[danielbb]

We have a case where -

index = network_index host=xx.xx.xx.xx
| eval lag_sec = (_indextime - _time)
| stats count by lag_sec

_time is current but _indextime is 37 minute earlier. 

What can it be? 

[PickleRick]

If _indextime is earlier than _time it most probably means some misconfiguration in the timezone department. And optionally - if the difference is not in full hours - lack of time sync, choking on reporting somewhere or a source which reads batches of events periodicaly.

But most probably there is some inconsistency between what source thinks it sends as timestamp and how splunk interprets it.

Check the raw data and look at the timestamps.