Typically you'd use an external infrastructure monitoring solution (like Nagios/Zabbix/whatever) to check the difference between host's time and a known reliable time source. The idea of monitoring time is always tricky. Especially with splunk where everything is time related and you can't trust the server's time to... monitor the server's time 🙂 So you either have to check the server's reported time and verify it with an external reliable source (but you can't report it using simply timestamps on events since events have unknown delay; so you'd need another way to query them near real-time) or have the servers themselves query a reliable time source and report their findings along with their own timestamp. But tha boils down to querying a remote NTP which is what I understand is failing in your case. ... View more

While this works perfectly for any number within last 24 hours but when I change time to 7 days or something else, title shows the "...in the Custom time" Any fix for this ? ... View more

I had a similar problem and ended up modifying $SPLUNK_HOME/etc/apps/splunk_app_db_connect/linux_x86_64/bin/customized.java.path which appears to retain whatever path was configured when the app was setup. I changed the contents to: /usr/java/latest/bin/java so it'll cover me the next time I upgrade. I don't know if this is recommended, but it did work. ... View more

Did you get solution for it? I had stuck at same place. ... View more

I have a single server SH and Indexer ... View more

Thanks a lot @russellliss. This was really helpful ... View more

how about 'Warnings and Errors' or 'Resource Usage'. You could also search index=_internal source="*splunkd.log*" err and see if you find something. Have you checked the ulimit (if on *nix) for the user running splunkd? ... View more

If you are running under windows, change the forward slashes to back slashes for the [script] ... View more