How To Fix Delay in Searchable Period

​@fatima  - I believe this issue was resolved by looking into a datasource that was sending events with a date in the future. If the issue was not resolved please let us know if the event time that you see from the source is now showing correctly and we can look into other configurations that would help.

Thank you!

The “x Hours in future” is generally a timezone configuration behaviour. This could be due to a mismatch in timezone configuration when configuring the DataSource, for example, Azure log sources typically operate a GMT/UTC 0 timezone , and the datasource may be configured to your local timezone. This can be easily corrected by modifying the overall timezone setting of the datasource.

The other scenario is when you have multiple devices with different timezone settings sending to a single datasource configured with a timezone. For example, you may have Windows Servers in the US, Singapore and Australia all sending to one Windows Security datasource configured with a single timezone. This can be rectified in two ways - either identify the servers and expolicitly define their respective timezones in the DataSource Activity configuration settings or, more drastically, configure multiple datasources, one for each datacenter or timezone.