In my case ran a packet capture between the switches and the Splunk server. Using this Splunk article I calculated the times and Splunk was correct. https://docs.splunk.com/Documentation/StreamApp/7.3.0/DeployStreamApp/UseStreamtoingestNetflowandIPFIXdata#How_NetFlow_event_timestamps_are_calculated It appeared to be the switches misreporting the time. I was planning to follow it up with the switch vendor, but we went in a different direction so I don't have any further updates, sorry! ... View more

Hi @gopenshaw, It looks like this user mdelwaide provided the answer you were looking for. I converted their comment to an answer so that you could approve it. Thanks! ... View more