SplunkTalk – #63 – Strange things happen after midnight

Yes yes yes… I know, its been a while–not because we’ve been silent, but we’ve been super busy and low on editing time. I’ve got a pile of them i’m about to release week by week so we’re all caught up. This episode, aptly titled “Strange things happen after midnight” has been waiting to get out of the gate. It’s been saying “Wilde! Edit me”. So I have.

Pay attention to your clocks my friend! Splunk Ninja answers a question (and helps diagnose) an issue where realtime search “seemed to not be working” when the real culprit was a forwarder whose time was ahead of the indexer–and thus, realtime isn’t the “future”. Well, it will be event-ually :). Maverick gives us some insight on the best ways to share whats in your Splunk server with other users in your company. Taking a cue from Gregg Woodcock, Splunk customer at MetroPCS–who presented at SplunkLive in Dallas–we’ve got some great tips worth sharing.. about sharing!

Splunk Ninja and the crew will be at Interop this year Wooo-hoo, in Las Vegas and NYC as a part of the Interop NOC (a.k.a nerd camp). Finally Maverick reveals what strange things happen right after midnight in Splunk (during an extremely rare situation).

Note: Check out our Developer Portal and send your vendors or developers over to the Logging section so they can learn how to better design log output so you can use it better!

Episodes are recorded live every Friday at 11AM Central Time – Email us at to ask questions and have them answered on air!

Michael Wilde

Posted by


Join the Discussion