Getting Data In

"Latest Event" on main search dashboard 12 hours ahead?

mmletzko
Path Finder

I have a Prod and QA instance of Splunk with 2 forwarders. Prod is v4.1.4, QA is v4.2.2. Both of them show a "latest event" on the home search screen 12 hours ahead of current time. Does anyone know where this would be coming from? The date/time on both indexers and 2 forwarders is fine.

Tags (1)
0 Karma
1 Solution

Greg_LeBlanc
Path Finder

Where are you getting your information from? If you're getting your information from external sources, I would check those times.

Or you could try searching for that record +12 hours ahead (using custom time) to see where the record is coming from.

View solution in original post

Greg_LeBlanc
Path Finder

Where are you getting your information from? If you're getting your information from external sources, I would check those times.

Or you could try searching for that record +12 hours ahead (using custom time) to see where the record is coming from.

mmletzko
Path Finder

Thanks Greg - that did the trick. Not sure why I didn't think of just using the future custom time.

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...