Hi there,
Often we get late events from Windows coming into Sentinel. They are
displayed and reported on based on the default of "Event Time" which
seems to be when the Sentinel server receives them. The "Observer Event
Time" field has the accurate time of the event.

Is there a way to change this so that Observer Event Time is used?


kmaule's Profile: https://forums.netiq.com/member.php?userid=306
View this thread: https://forums.netiq.com/showthread.php?t=46321