topic Re: Indexing Time Differs From Raw Log Time in Splunk Dev

Indexing Time Differs From Raw Log Time

anandhalagarasa — Tue, 22 Aug 2017 05:59:27 GMT

Hi All,

We have configured log monitoring for set of servers. And when we searched the data for last 15 minutes, the raw data has a time in GMT and indexed time (Time) column is USA.

So kindly help to provide a solution to fix it asap.

Re: Indexing Time Differs From Raw Log Time

anandhalagarasa — Tue, 22 Aug 2017 10:06:14 GMT

Can anyone help on my query

Re: Indexing Time Differs From Raw Log Time

niketn — Tue, 22 Aug 2017 10:32:46 GMT

What is the field/SPL you are using to compare time? is it _time or _indextime?

Re: Indexing Time Differs From Raw Log Time

DalJeanis — Tue, 22 Aug 2017 13:38:13 GMT

Okay, first thing, you will save yourself a WHOLE lot of pain if you have your indexer (really all your hosts) running UTC. I realize you don't have personal control over that, but it is something to mention to the senior techs pretty much every time this kind of thing comes up. Eventually when they propose this great bright idea to move everything over to UTC, you just keep your mouth shut and nod, so it gets done and a bunch of your headaches go away.

Second thing, have you verified that your indexers are not backlogged? (Assuming you were really talking about indextime, which has nothing to do with the event _time.) It is not great for them to be taking 15 minutes to catch up to ingest a particular event, but it's not an error.

Third, verify that your time configuration in props.conf for the appropriate sourcetype matches the event. Looks to me like your look-ahead needs to be at least 38-40 characters, and the time format should be this -

%Y-%m-%dT%H:%M:%S.%6N%:z

Re: Indexing Time Differs From Raw Log Time

anandhalagarasa — Wed, 23 Aug 2017 07:33:14 GMT

its _time.