topic Re: Splunk Linux TA - packages script, some hosts have time in the future in Getting Data In

Splunk Linux TA - packages script, some hosts have time in the future

splunk219783 — Thu, 22 Jul 2021 14:38:31 GMT

I'm running what I believe to be a somewhat standard input, from the Splunk Linux TA. I just realized for some hosts the time is in the future. All other time for logs from these hosts is correct, only the package.sh output is 15 minutes in the future.

Time on the affected hosts is correct. How can it have the wrong time when it was a script Splunk executed itself?

Input:

[script:///opt/splunkforwarder/etc/apps/Splunk_TA_nix/bin/package.sh] sourcetype = package source = package interval = 86400 disabled = false index = os

Re: Splunk Linux TA - packages script, some hosts have time in the future

codebuilder — Fri, 23 Jul 2021 19:38:57 GMT

Have you checked to be sure the time zone set for your user matches the time zone on the server?

Re: Splunk Linux TA - packages script, some hosts have time in the future

splunk219783 — Thu, 29 Jul 2021 12:55:18 GMT

My timezone is set to default system timezone.

Looking at it now, it seems to primarily be one sourcetype mailog-too-small, but only on some hosts.

The event has the correct time, but the actual event time is 4 hours ahead.