Does the Splunk universal forwarder offer some sort of time monitoring feature? (TOCTOU?)

All, SO bad guy changes the time on the system. Does the fowarder KNOW there is a sudden time change and log it? I think security pros call this TOCTOU? https://en.wikipedia.org/wiki/Time_of_check_to_time_of_use