I have a Prod and QA instance of Splunk with 2 forwarders. Prod is v4.1.4, QA is v4.2.2. Both of them show a "latest event" on the home search screen 12 hours ahead of current time. Does anyone know where this would be coming from? The date/time on both indexers and 2 forwarders is fine.
Where are you getting your information from? If you're getting your information from external sources, I would check those times.
Or you could try searching for that record +12 hours ahead (using custom time) to see where the record is coming from.
Where are you getting your information from? If you're getting your information from external sources, I would check those times.
Or you could try searching for that record +12 hours ahead (using custom time) to see where the record is coming from.
Thanks Greg - that did the trick. Not sure why I didn't think of just using the future custom time.