topic Re: Timestamp not being parsed correctly - Perfmon in Getting Data In

Timestamp not being parsed correctly - Perfmon

rturk — Mon, 28 Sep 2020 15:15:27 GMT

Hi All,

I am collecting Perfmon data via the Splunk_TA_windows app and for some reason the time stamp is not being parsed correctly, specifically there is a delta between the Splunk assigned timestamp and the on in the event itself. e.g.:

Having looked through the internal logs I am not seeing anywhere that would indicate the queues are blocked, but I am still getting this discrepency. No modifications have been made to the TA , and it is has been installed on both the server that is sending the data, and the Indexer.

Any & all suggestions appreciated!

Re: Timestamp not being parsed correctly - Perfmon

lukejadamec — Tue, 12 Nov 2013 23:31:06 GMT

There is something wrong with your time. As of the time of your posting it was not 11/12/13 23:00 hours anywhere on the planet. Are you in space?
Are you seeing the same thing with other servers' forwarders?

Re: Timestamp not being parsed correctly - Perfmon

royimad — Mon, 25 Nov 2013 09:25:06 GMT

Add time zone to your time and this should be fixed

Re: Timestamp not being parsed correctly - Perfmon

rturk — Mon, 25 Nov 2013 22:42:34 GMT

Unfortunately this won't help, as timezones differ (at a maximum) of 30 second increments. The delta above is ~2 minutes.