Creating a metadata report gives wrong date

[EldadDor]

I've found in the forum a nice way to query the metadata tables to check if our servers are writing logs,

the search term I'm using:

| metadata type=hosts index=distrib | eval mytime=strftime (recentTime, "%y-%m-%d %H:%M:%S") | eval currentTime=strftime(now(), "%y-%m-%d %H:%M:%S") | eval minutesAgo=round(((now()-recentTime)/60),0) | table sourcetype,host,lastTime,source,recentTime,mytime,currentTime,minutesAgo | where (abs(minutesAgo) > 1)

which works great, but when I'm using it as a report, the generated report gives
the current time as 70-01-01 02:00:00.
The TimeRange configured is

start time: rt-1m

finish time: rt

(I've tried some other time variations, but always got the same result)

(btw we're using Splunk 6)

Can you provide any help on the subject?

[EldadDor]

Did the trick 🙂

[martin_mueller]

Use time() instead of now(). The latter gives you the time the search was launched, and can be trouble in certain constellations. Using time() will also self-update the timestamp over the potentially long-running realtime search.