Why is my Splunk indexer showing Latest "in 15hours"?

[cassiusc]

I am showing some of my indexers' Latest collection times as "a second ago." On others, it show "in 15 hours." What does this mean for the real-time monitoring of my directory? Is this an error or a throughput limitation?

[sk314]

It means your logs are coming in with a timestamp greater than your local time. You could specify the TZ in props.conf for your sourcetype like so:

props.conf

[<your sourcetype>]
TZ = <time zone of the logs>

Ref: http://docs.splunk.com/Documentation/Splunk/6.4.1/data/Applytimezoneoffsetstotimestamps

For Time-zone identifiers: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones

Also, this is a common issue: https://answers.splunk.com/answers/1650/why-are-log-sent-to-splunk-in-gmt-displayed-in-the-future.ht...

[cassiusc]

Hello,

I verified that both Splun Fwrd. client and Splunk Ent. server are in the same AWS region/AWS zone/time zone. Also, I don't have a props.conf file in my .../etc/system/local directory.

Thanks,
C2