topic Re: timezone issue with custom log time date stamp in Getting Data In

timezone issue with custom log time date stamp

ebailey — Mon, 28 Sep 2020 16:47:28 GMT

I have a log with a custom time date stamp. I am running into an issue where the index time is exactly one hour ahead of the event time stamp in the log. Could this be an issue with how I defined the date stamp in my props? I should add that the application server and the splunk server are set to use CST and have the correct system time.

Here is a time stamp from the log

2014-06-04T11:38:15.190 CST

My props for the time stamp

[prd_ufo_stats]
TIME_PREFIX = ^
MAX_TIMESTAMP_LOOKAHEAD = 20
TIME_FORMAT = %Y-%m-%dT%H:%M:%S:%3N %Z
LINE_BREAKER = ([\r\n]+)
SHOULD_LINEMERGE = False
TRUNCATE = 100000
KV_MODE = None

Thanks!

Re: timezone issue with custom log time date stamp

jarjoh42 — Wed, 04 Jun 2014 18:06:06 GMT

This doc should help fix your time stamp issue

http://docs.splunk.com/Documentation/Splunk/6.1.1/Data/ApplyTimezoneOffsetsToTimeStamps

Re: timezone issue with custom log time date stamp

ebailey — Wed, 04 Jun 2014 18:22:57 GMT

Missing something- the props for this sourcetype is on the search head so I made the change and added "TZ = US/Central" and then restarted the search head with no difference.

Do I need to drop %Z from the timestamp defined in props? Everything involved with the data stream is in CST so I am not sure why this is the issue other than the custom time date stamp.

Re: timezone issue with custom log time date stamp

k_harini — Wed, 17 Jan 2018 12:42:11 GMT

Did this work? I'm facing same issue