What will happen on indexed data if we revert system time?

[crt89]

Hi,

We have a set of indexed logs from a server currently there's no new data that has been indexed. The data computes the count of certain values (ex Total Percentage of Rejected SMS count vs Succeessfull SMS count). We are currently checking the results of Splunk to our manual computation. We have found out that we have a high variance but the percentage count is not that high. Upon checking we found out that the server time is 9 hours advance on our time.

My question is what will happen if we tried to change the server time? Will the data be re-indexed? We are not sure if this was the problem with the count of our variance.

Thanks,

crt

[dshpritz · Accepted solution]

Splunk stores the event time in epoch. This is an integer, which represents the number of seconds since 1/1/1970. Setting the system time back will not change the stored event time, nor will Splunk re-index the data.

[yannK]

Beware, the indexed events that will now be in the future will not returned by a search.
Until they are no more in the future 🙂

[crt89]

Thanks for your reply, so its safe to revert our server time back. We'll try again to search hope to be able to have a much lower variance.