Getting Data In

How to time warp from a certain IP?


We have a case where -


index = network_index host=xx.xx.xx.xx
| eval lag_sec = (_indextime - _time)
| stats count by lag_sec


_time is current but _indextime is 37 minute earlier. 

What can it be? 

Labels (1)
Tags (1)
0 Karma

Ultra Champion

If _indextime is earlier than _time it most probably means some misconfiguration in the timezone department. And optionally - if the difference is not in full hours - lack of time sync, choking on reporting somewhere or a source which reads batches of events periodicaly.

But most probably there is some inconsistency between what source thinks it sends as timestamp and how splunk interprets it.

Check the raw data and look at the timestamps.

0 Karma
Get Updates on the Splunk Community!

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...

Announcing General Availability of Splunk Incident Intelligence!

Digital transformation is real! Across industries, companies big and small are going through rapid digital ...