Getting Data In

"Latest Event" on main search dashboard 12 hours ahead?

Path Finder

I have a Prod and QA instance of Splunk with 2 forwarders. Prod is v4.1.4, QA is v4.2.2. Both of them show a "latest event" on the home search screen 12 hours ahead of current time. Does anyone know where this would be coming from? The date/time on both indexers and 2 forwarders is fine.

Tags (1)
0 Karma
1 Solution

Path Finder

Where are you getting your information from? If you're getting your information from external sources, I would check those times.

Or you could try searching for that record +12 hours ahead (using custom time) to see where the record is coming from.

View solution in original post

Path Finder

Where are you getting your information from? If you're getting your information from external sources, I would check those times.

Or you could try searching for that record +12 hours ahead (using custom time) to see where the record is coming from.

View solution in original post

Path Finder

Thanks Greg - that did the trick. Not sure why I didn't think of just using the future custom time.

0 Karma