I've found in the forum a nice way to query the metadata tables to check if our servers are writing logs, the search term I'm using: | metadata type=hosts index=distrib | eval mytime=strftime (recentTime, "%y-%m-%d %H:%M:%S") | eval currentTime=strftime(now(), "%y-%m-%d %H:%M:%S") | eval minutesAgo=round(((now()-recentTime)/60),0) | table sourcetype,host,lastTime,source,recentTime,mytime,currentTime,minutesAgo | where (abs(minutesAgo) > 1) which works great, but when I'm using it as a report, the generated report gives the current time as 70-01-01 02:00:00 . The TimeRange configured is start time: rt-1m finish time: rt (I've tried some other time variations, but always got the same result) (btw we're using Splunk 6) Can you provide any help on the subject? ... View more