Detect Clock Skew

| rest /services/server/info
| eval updated_t=round(strptime(updated, "%Y-%m-%dT%H:%M:%S%z"))
| eval delta_t=now()-updated_t
| eval delta=tostring(abs(delta_t), "duration")
| table serverName, updated, updated_t, delta, delta_t

purpose:

Check for server clock skew

requirements:

comments:

If delta is anything other than about 00:00:01 (which is easy to account for when processing a lot of indexers), you may have clock skew.