Why were logs indexed at a time when Splunk was not running on the host?

[Madhan45]

Splunk was running on the time period 00:00 07:00. and stopped at 07:00, but few logs were captured at the time 08:15.

How is it possible?

[ktugwell_splunk]

Could be a couple of reasons but it usually depends on the method in which the logs are collected.

If Splunk is receiving logs from a forwarder, then as soon as Splunk comes back on, the forwarder will forward these queued events with the timestamp of when the log was created.

You could have also had logs indexed during the uptime with a timestamp that is in the future.

Try looking at the _indextime of your logs

 | eval indextime=strftime(_indextime,"%Y-%m-%d %H:%M:%S")