https://community.splunk.com/t5/Getting-Data-In/What-is-causing-Constant-time-diff-of-12-hrs-indextime-time/m-p/595765#M104055 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/196109">@pavanbmishra</a>,</P><P>a fixed difference like this can have one of the following three causes:</P><UL><LI>there's a timezone difference to consider;</LI><LI>a timestamp parsing error: the timestamp parsing doesn't consider AM/PM;</LI><LI>servers internal clock aren't aligned.</LI></UL><P>In my experience the fist option is the more possible.</P><P>In this case you have to analyze your logs and the parser and change the timezone setting.</P><P>Ciao.</P><P>Giuseppe</P> Thu, 28 Apr 2022 10:04:15 GMT gcusello 2022-04-28T10:04:15Z https://community.splunk.com/t5/Getting-Data-In/What-is-causing-Constant-time-diff-of-12-hrs-indextime-time/m-p/595762#M104054 <P>Hi,</P> <P>&nbsp;</P> <P>There is constant time diff (_indextime - _time) from few windows server as below, not sure what causing this and how to fix it</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="pavanbmishra_0-1651137952203.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/19366iD1DBAE971647455D/image-size/medium?v=v2&amp;px=400" role="button" title="pavanbmishra_0-1651137952203.png" alt="pavanbmishra_0-1651137952203.png" /></span></P> <P>&nbsp;</P> Thu, 28 Apr 2022 18:09:55 GMT https://community.splunk.com/t5/Getting-Data-In/What-is-causing-Constant-time-diff-of-12-hrs-indextime-time/m-p/595762#M104054 pavanbmishra 2022-04-28T18:09:55Z https://community.splunk.com/t5/Getting-Data-In/What-is-causing-Constant-time-diff-of-12-hrs-indextime-time/m-p/595765#M104055 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/196109">@pavanbmishra</a>,</P><P>a fixed difference like this can have one of the following three causes:</P><UL><LI>there's a timezone difference to consider;</LI><LI>a timestamp parsing error: the timestamp parsing doesn't consider AM/PM;</LI><LI>servers internal clock aren't aligned.</LI></UL><P>In my experience the fist option is the more possible.</P><P>In this case you have to analyze your logs and the parser and change the timezone setting.</P><P>Ciao.</P><P>Giuseppe</P> Thu, 28 Apr 2022 10:04:15 GMT https://community.splunk.com/t5/Getting-Data-In/What-is-causing-Constant-time-diff-of-12-hrs-indextime-time/m-p/595765#M104055 gcusello 2022-04-28T10:04:15Z https://community.splunk.com/t5/Getting-Data-In/What-is-causing-Constant-time-diff-of-12-hrs-indextime-time/m-p/595766#M104056 <P>Thanks Giuseppe, seems to be AM/PM parsing issue. How this could be addressed?</P> Thu, 28 Apr 2022 10:06:02 GMT https://community.splunk.com/t5/Getting-Data-In/What-is-causing-Constant-time-diff-of-12-hrs-indextime-time/m-p/595766#M104056 pavanbmishra 2022-04-28T10:06:02Z https://community.splunk.com/t5/Getting-Data-In/What-is-causing-Constant-time-diff-of-12-hrs-indextime-time/m-p/595772#M104057 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/196109">@pavanbmishra</a>,</P><P>you should see your logs and the props.conf related to your sourcetype and eventually add to it the timezone definition.</P><P>Ciao.</P><P>Giuseppe</P> Thu, 28 Apr 2022 10:19:07 GMT https://community.splunk.com/t5/Getting-Data-In/What-is-causing-Constant-time-diff-of-12-hrs-indextime-time/m-p/595772#M104057 gcusello 2022-04-28T10:19:07Z