topic Re: How can we use original timestamps with distributed search indexers in Getting Data In

How can we use original timestamps with distributed search indexers

fox — Fri, 03 Dec 2010 00:23:56 GMT

Architecture: Two splunk servers: 1. London as search and local indexing. 2. New York as local indexing only.

The events in question have the correct timestamp in the log file and it has been established when searched on each of the local indexers that the correct timestamp (ie that of the local time) has been indexed correctly

When searching for New York events on the London server, the New York events seem to be getting automatically adjusted in the search results- this we don't want. We know that all events are indexed with the correct timestamp. How can we use the timestamps that we have in the raw indexes?

Re: How can we use original timestamps with distributed search indexers

Rob — Mon, 06 Dec 2010 22:22:57 GMT

I am assuming that you do not want to use the Splunk time extractor which extracts the logged timestamp and "normalizes" it according to time zones at all? In which case you will want to edit/create the props.conf file in $SPLUNK_HOME/etc/system/local/ with the following stanza:

[default] DATETIME_CONFIG = NONE

This will turn off all the time adjustments. You can also set the option to "CURRENT" which will insert the current system time or you can take a look at the datetime.xml file which Splunk uses for the conversion.

There are some other options for configure time zones which you can find here.

For information about Splunk timestamp recognition, you can check out the docs here.