topic Re: Disface on "_time" variable on SPLUNKFORDWARD in Splunk Enterprise

Disface on "_time" variable on SPLUNKFORDWARD

gbriones — Wed, 25 Aug 2021 15:51:59 GMT

Hi,

I have a problem and I can review event exists a disface between variable time extract and "_time" on SPL

file:

T_LOGFILE_VORDEL_ANSWER_SLA10_1;0;08/25/2021 09:03:08

on SPLUNK

Re: Disface on "_time" variable on SPLUNKFORDWARD

richgalloway — Wed, 25 Aug 2021 21:16:58 GMT

Verify the time zone is set correctly in your Splunk preferences.

Verify the data is onboarded correctly. Check props.conf for the correct TIME_FORMAT setting. Add a TZ setting so Splunk knows the time zone in which the event was generated.

Re: Disface on "_time" variable on SPLUNKFORDWARD

gbriones — Wed, 25 Aug 2021 20:32:04 GMT

add on props.conf and still the problem:

...
disabled=false
pulldown_type=true
TZ=America/Santiago
TIME_FORMAT = %m/%d/%Y %H:%M:%S