Synchronization of system clocks

It is important that the system clocks on all machines that are running Splunk Enterprise and participating in a cluster—your cluster master node, peer nodes, and search heads—are time-synchronized. Otherwise, issues can arise such as timing problems between the master and peer nodes, search failures, or premature expiration of search artifacts. Most environments employ the Network Time Protocol (NTP) for this purpose; you will want to ensure that this function is configured and working correctly across all your machines.