Splunk Indexing Question

[andrew_burnett]

My index shows the latest event section "in an hour", I have never seen that before. What exactly does that mean?Screenshot (51).png

[PickleRick · Accepted solution]

I can't see your screenshot clearly (the left half of it is completely unnecessary ;)) but in general "in <time spec>" means a timestamp in the future. So you probably have some misconfiguration and some events are either sent with a timestamp from the future or are getting parsed as such. Typical scenario - timezone mismatch between the sender and sourcetype config.