- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Splunk Version: 6.4.0
Splunk Build: f2c836328108
We collect data from Cisco Asa firewalls (5). We are able to search data from all the firewalls when I use the time parameter "all time" However when I try to use other time criteria like "last 7 days" or specific dates, the search doesn't work for one of the firewalls. The same search works if I use another firewall. The data is in the index however I don't get results unless I use "All Time"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Have you specified the time zone of your data in props.conf on either the heavy forwarder, or on the indexers (if you're using a universal forwarder)?
Take a look at the "TZ" parameter in props.conf
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Have you specified the time zone of your data in props.conf on either the heavy forwarder, or on the indexers (if you're using a universal forwarder)?
Take a look at the "TZ" parameter in props.conf
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @dnorman289
Check your internals for a timestamp format related events, you will probably have to specifiy the timestamp format on your props.conf.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

What date and time are on the events when you use the "All Time" search? My guess is one of your 5 firewalls has the time off.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

When I perform a tcpdump at the indexer I can see the data inbound to the server.
