"Latest Event" on main search dashboard 12 hours ahead?

[mmletzko]

I have a Prod and QA instance of Splunk with 2 forwarders. Prod is v4.1.4, QA is v4.2.2. Both of them show a "latest event" on the home search screen 12 hours ahead of current time. Does anyone know where this would be coming from? The date/time on both indexers and 2 forwarders is fine.

[Greg_LeBlanc · Accepted solution]

Where are you getting your information from? If you're getting your information from external sources, I would check those times.

Or you could try searching for that record +12 hours ahead (using custom time) to see where the record is coming from.

[mmletzko]

Thanks Greg - that did the trick. Not sure why I didn't think of just using the future custom time.