Getting Data In

"Latest Event" on main search dashboard 12 hours ahead?

mmletzko
Path Finder

I have a Prod and QA instance of Splunk with 2 forwarders. Prod is v4.1.4, QA is v4.2.2. Both of them show a "latest event" on the home search screen 12 hours ahead of current time. Does anyone know where this would be coming from? The date/time on both indexers and 2 forwarders is fine.

Tags (1)
0 Karma
1 Solution

Greg_LeBlanc
Path Finder

Where are you getting your information from? If you're getting your information from external sources, I would check those times.

Or you could try searching for that record +12 hours ahead (using custom time) to see where the record is coming from.

View solution in original post

Greg_LeBlanc
Path Finder

Where are you getting your information from? If you're getting your information from external sources, I would check those times.

Or you could try searching for that record +12 hours ahead (using custom time) to see where the record is coming from.

mmletzko
Path Finder

Thanks Greg - that did the trick. Not sure why I didn't think of just using the future custom time.

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...