Getting Data In

How to time warp from a certain IP?


We have a case where -


index = network_index host=xx.xx.xx.xx
| eval lag_sec = (_indextime - _time)
| stats count by lag_sec


_time is current but _indextime is 37 minute earlier. 

What can it be? 

Labels (1)
Tags (1)
0 Karma

Ultra Champion

If _indextime is earlier than _time it most probably means some misconfiguration in the timezone department. And optionally - if the difference is not in full hours - lack of time sync, choking on reporting somewhere or a source which reads batches of events periodicaly.

But most probably there is some inconsistency between what source thinks it sends as timestamp and how splunk interprets it.

Check the raw data and look at the timestamps.

0 Karma
Get Updates on the Splunk Community!

Don't wait! Accept the Mission Possible: Splunk Adoption Challenge Now and Win ...

Attention everyone! We have exciting news to share! We are recruiting new members for the Mission Possible: ...

Unify Your SecOps with Splunk Mission Control

In today’s post, I'm excited to share some recent Splunk Mission Control innovations. With Splunk Mission ...

Data Preparation Made Easy: SPL2 for Edge Processor

By now, you may have heard the exciting news that Edge Processor, the easy-to-use Splunk data preparation tool ...