topic Re: timestamp and itime does not match in Getting Data In

timestamp and itime does not match

phamanh1652 — Wed, 13 Aug 2025 03:54:52 GMT

We’re using Splunk Cloud and have configured SC4S to collect logs from FortiAnalyzer, which receives logs from both FortiGate and FortiWeb devices. Most events are processed correctly, with the timestamp and itime fields matching. However, we’ve noticed that for some events from FortiWeb, the timestamp is ahead of the itime by approximately 14–15 minutes. Based on our analysis, itime reflects the actual time the event occurred.

I’ve reviewed the raw logs and confirmed that all related components are configured to use the same time zone. Has anyone else experienced this issue? Any insights or solutions would be greatly appreciated.

Re: timestamp and itime does not match

PrewinThomas — Wed, 13 Aug 2025 04:49:37 GMT

@phamanh1652

Can you check system time on fortiweb? Is it configured locally or NTP?

#https://docs.fortinet.com/document/fortiweb/7.0.11/administration-guide/780143/setting-the-system-time-date

Regards,
Prewin
Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

Re: timestamp and itime does not match

PickleRick — Wed, 13 Aug 2025 05:50:13 GMT

Such offset (unless you're in a very very unusual time zone) suggests that either:

1) Time on the source is not set correctly or

2) There is an ingestion lag and (this is used as conjunction, not consequence) the timestamp is not parsed from the event itself but assigned from the time of ingestion.

Re: timestamp and itime does not match

phamanh1652 — Fri, 15 Aug 2025 05:01:26 GMT

Hello,

FortiWeb is configured with NTP.

Regards,

Re: timestamp and itime does not match

PickleRick — Fri, 15 Aug 2025 06:04:36 GMT

Btw, what do you mean by itime? Index time? How can it be ahead of the actual time?

Re: timestamp and itime does not match

phamanh1652 — Fri, 15 Aug 2025 06:57:09 GMT

This is an event of Fortiweb:

event time of splunk 11:53:13

timestamp=1755258793 ==> 11:53:13

itime=1755234267 ==> 12:04:27 ==> This is the actual time the event occurred.

Re: timestamp and itime does not match

PickleRick — Fri, 15 Aug 2025 19:10:37 GMT

So it's actually the fortigate solution that is "lagging". If the main timestamp for the event should be the itime one, you need to change your props for that sourcetype to use that timestamp instead of the one at timestamp field