I am showing some of my indexers' Latest collection times as "a second ago." On others, it show "in 15 hours." What does this mean for the real-time monitoring of my directory? Is this an error or a throughput limitation?
It means your logs are coming in with a timestamp greater than your local time. You could specify the TZ in props.conf for your sourcetype like so:
props.conf
[<your sourcetype>]
TZ = <time zone of the logs>
Ref: http://docs.splunk.com/Documentation/Splunk/6.4.1/data/Applytimezoneoffsetstotimestamps
For Time-zone identifiers: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones
Also, this is a common issue: https://answers.splunk.com/answers/1650/why-are-log-sent-to-splunk-in-gmt-displayed-in-the-future.ht...
Hello,
I verified that both Splun Fwrd. client and Splunk Ent. server are in the same AWS region/AWS zone/time zone. Also, I don't have a props.conf file in my .../etc/system/local directory.
Thanks,
C2