Log time differs from time on splunk host

suhprano — Tue, 02 Aug 2011 23:44:46 GMT

I'm running splunk in windows where the time is in PST.

I read logs in GMT time, so when I search for most recent, it yields 0 results because all my data is indexed in GMT time (technically in the future).

Example:
IIS log

2011-08-02 23:42:01 W3SVC1...

But current time on system is 4:42 PM PST.

So when I issue a search for the current time, it searches and returns for data at 4:442PM PST, not 4:42PM GMT.

Is there a work around for this?

Re: Log time differs from time on splunk host

MartinHarper — Mon, 08 Aug 2011 18:27:40 GMT

This page explains how to set up Splunk’s props.conf to convert data sources from a specified time format: Specify Timezones of Timestamps

Example: to set all IIS sources to be imported from UTC, add:

[sourcetype::iis]
TZ = Etc/UTC

This assumes that your IIS logs have a sourcetype of "iis" - adjust appropriately for your system.

topic Log time differs from time on splunk host in Getting Data In

Log time differs from time on splunk host

Re: Log time differs from time on splunk host