topic Re: How will Splunk handle the clock change for leap seconds in June 2012? in Getting Data In https://community.splunk.com/t5/Getting-Data-In/How-will-Splunk-handle-the-clock-change-for-leap-seconds-in-June/m-p/58605#M11531 <P>There is an interesting wiki about the leap second at <A href="https://en.wikipedia.org/wiki/Leap_second">https://en.wikipedia.org/wiki/Leap_second</A>, for those curious to better understand.</P> Sat, 28 Feb 2015 01:32:15 GMT ntbahriti_splun 2015-02-28T01:32:15Z How will Splunk handle the clock change for leap seconds in June 2012? https://community.splunk.com/t5/Getting-Data-In/How-will-Splunk-handle-the-clock-change-for-leap-seconds-in-June/m-p/58603#M11529 <P>See this webpage for reference - <A href="http://www.timeanddate.com/time/leapseconds.html">http://www.timeanddate.com/time/leapseconds.html</A></P> <P>On June 30 2012, an extra second will be added to UTC, which will result in events with a timestamp of 'Jun 30 23:59:60' - Will Splunk recognize this as a valid timestamp? </P> <P>I have multiline event log files that are broken based on the timestamp in the events, will Splunk still break the events properly?</P> Wed, 23 May 2012 17:30:46 GMT https://community.splunk.com/t5/Getting-Data-In/How-will-Splunk-handle-the-clock-change-for-leap-seconds-in-June/m-p/58603#M11529 mctester 2012-05-23T17:30:46Z Re: How will Splunk handle the clock change for leap seconds in June 2012? https://community.splunk.com/t5/Getting-Data-In/How-will-Splunk-handle-the-clock-change-for-leap-seconds-in-June/m-p/58604#M11530 <P>If you are breaking events based on timestamps, that extraction should still work as the format of the timestamp will not change and that is what the linebreaking processor is interested in. What that timestamp actually means in real terms is not a consideration when identifying where to break events. </P> <P>Any events containing the timestamp with a leap second will be indexed as 23:59:59, and will be searchable.</P> Wed, 23 May 2012 18:16:04 GMT https://community.splunk.com/t5/Getting-Data-In/How-will-Splunk-handle-the-clock-change-for-leap-seconds-in-June/m-p/58604#M11530 matt 2012-05-23T18:16:04Z Re: How will Splunk handle the clock change for leap seconds in June 2012? https://community.splunk.com/t5/Getting-Data-In/How-will-Splunk-handle-the-clock-change-for-leap-seconds-in-June/m-p/58605#M11531 <P>There is an interesting wiki about the leap second at <A href="https://en.wikipedia.org/wiki/Leap_second">https://en.wikipedia.org/wiki/Leap_second</A>, for those curious to better understand.</P> Sat, 28 Feb 2015 01:32:15 GMT https://community.splunk.com/t5/Getting-Data-In/How-will-Splunk-handle-the-clock-change-for-leap-seconds-in-June/m-p/58605#M11531 ntbahriti_splun 2015-02-28T01:32:15Z