Okay, running this query: index=_internal sourcetype=scheduler savedsearch_name=dip-summary-revenue-by-minute status=success I get this result: 9/1/20 9:24:24.796 AM 09-01-2020 14:24:24.796 + 0000 INFO SavedSplunker - savedsearch_id= " nobody ; dip-summary-revenue-by-minute ", search_type= " scheduled ", user= " admin ", app= " myapp ", savedsearch_name= " dip-summary-revenue-by-minute ", priority=default , status=success , digest_mode=1 , scheduled_time=1598970000 , window_time=-1 , dispatch_time=1598970264 , run_time=0.497 , result_count=5 , alert_actions= "", sid= " scheduler__admin__myapp__RMD5a5372a05036e6d57_at_1598970000_39293 ", suppressed=0 , thread_id= " AlertNotifierWorker-0 ", workload_pool= "" When I run my query to get the latest data right after running the above query: index=prod-summary-revenue source="summary_revenue_by_minute" | convert ctime(info_min_time) AS minTime | convert ctime(info_max_time) AS maxTime | convert ctime(info_search_time) AS searchTime | sort by -_time | table _time minTime maxTime searchTime _raw I get these results: 2020-09-01 09:18:00 09/01/2020 09:14:00.000 09/01/2020 09:19:00.000 09/01/2020 09:24:24.104 09/01/2020 09:18:00 -0500, search_name="dip-summary-revenue-by-minute", search_now=1598970000.000, info_min_time=1598969640.000, info_max_time=1598969940.000, info_search_time=1598970264.104, numOrdersByMinute=171, revenueByMinute="909.96" 2020-09-01 09:17:00 09/01/2020 09:14:00.000 09/01/2020 09:19:00.000 09/01/2020 09:24:24.104 09/01/2020 09:17:00 -0500, search_name="dip-summary-revenue-by-minute", search_now=1598970000.000, info_min_time=1598969640.000, info_max_time=1598969940.000, info_search_time=1598970264.104, numOrdersByMinute=167, revenueByMinute="882.49" 2020-09-01 09:16:00 09/01/2020 09:14:00.000 09/01/2020 09:19:00.000 09/01/2020 09:24:24.104 09/01/2020 09:16:00 -0500, search_name="dip-summary-revenue-by-minute", search_now=1598970000.000, info_min_time=1598969640.000, info_max_time=1598969940.000, info_search_time=1598970264.104, numOrdersByMinute=150, revenueByMinute="830.47" 2020-09-01 09:15:00 09/01/2020 09:14:00.000 09/01/2020 09:19:00.000 09/01/2020 09:24:24.104 09/01/2020 09:15:00 -0500, search_name="dip-summary-revenue-by-minute", search_now=1598970000.000, info_min_time=1598969640.000, info_max_time=1598969940.000, info_search_time=1598970264.104, numOrdersByMinute=122, revenueByMinute="606.37" Confirming that instead of the generated data being in the 1-6 minute old range, it's 6-11 minutes old (offset 5 minutes in the past from what we expected). btw, not sure it's that important to mention, but this is with splunk cloud. Dr_j
... View more