topic How splunk assigns timestamp in Getting Data In

How splunk assigns timestamp

splunker12er — Thu, 14 May 2015 03:49:22 GMT

I have configured a firewall device (Cisco) to send logs to my splunk indexer .
I receive events in the device timezone (Eg: Timezone : JST (Japan) each events have timestamp)
I am searching events in splunk search head (indexer,search head in UTC Timezone). say Last 15 min -- which means splunk server time last 15 min. i.e. UTC . where i will not see the device logs here.
Later I re-configure my cisco device to UTC timezone.
Now , I can search logs for the device in UTC timezone.

Does the older logs in JST time is still remains in same format (JST) OR it configures to UTC timezone ?

Re: How splunk assigns timestamp

richgalloway — Thu, 14 May 2015 03:54:43 GMT

Changing the configuration of the Cisco device has no effect on logs already in Splunk,

Re: How splunk assigns timestamp

grijhwani — Thu, 14 May 2015 12:54:41 GMT

Splunk has no reference back to the current state of the original source of any data. All it knows about is what it already has in its possession. This is why it is important to get the data (and extraction rules) right in the indexing input/parsing phases. Once you have it, short of re-importing (and hence hitting your input allocation), you can do nothing about historic data.