Splunk showing 2 different times

[jensterddcaa]

Hello! in the process of checking time on our Splunk server, I came up with some puzzling results.

If I do a search query on my search head, I get this result: 2019-10-01T08:16:00-0400
Query is: * | stats count | eval clock = strftime(time(), "%Y-%m-%dT%H:%M:%S%z") | table clock

If I query through the Splunk API, I get this results: 1969-12-31T19:00:00-05:00
rest /services/server/info | eval updated_t=round(strptime(updated, "%Y-%m-%dT%H:%M:%S%z"), 2)

That's a 50 year difference! Any help greatly appreciated.

[richgalloway]

In most Splunk REST queries, the updated field is zero. I've rarely seen it populated and wouldn't rely on it for anything.