Indexes being created with "future" dates

[rferebee]

Good afternoon,

Not sure why, but for the past couple of weeks my Log Server environment has been creating new indices with future dates. I removed most of them on Wednesday of this week, but today there are two more.

Both have dates from November 2020. See screenshot.

Any idea what might be causing this to happen?

Thank you.

[cdienger]

It is usually due to sending devices with the incorrect time stamp. Open the indices and then use the dashboard to look at events for the month of November and you should find the IP of the sending devices.

[rferebee]

Great, thank you. We got it figured out. You can lock this.

[cdienger]

Glad to help!