topic Re: How to fix an incorrectly indexed timestamp? in Getting Data In

How to fix an incorrectly indexed timestamp?

mholden37 — Wed, 22 Feb 2017 18:59:45 GMT

Splunk is not showing the correct time on the events. The time that Splunk gives the log is 5 hours behind the time that it is supposed to be. The time is correct on the server and the logs but Splunk is saying it is 5 hours behind. For the below timestamp it is giving it a time of 8:48:06.000 AM when it should be 1:48:06.000PM.

2017-02-22T13:48:06Z

In props.conf I have TIME_FORMAT=%Y-%m-%dT%H:%M:%SZ

I have also tried changing the timezone to TZ = UTC and that did not fix it.

Re: How to fix an incorrectly indexed timestamp?

richgalloway — Wed, 22 Feb 2017 19:20:04 GMT

If your Splunk is in the US eastern time zone then 13:48:06Z correctly converts to 08:48:06 EST. The "Z" says the timestamp is in UTC so Splunk converts it to the local time zone. If that is not the expected behavior then change the server to specify the correct time zone in its events.

Re: How to fix an incorrectly indexed timestamp?

sloshburch — Mon, 27 Feb 2017 22:12:29 GMT

What happens when you set the time to be parsed automatically?
Alternatively, try using the strptime to validate the string parsing.
For example, you could also try %FT%TZ as per https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Commontimeformatvariables

Re: How to fix an incorrectly indexed timestamp?

aaraneta_splunk — Thu, 20 Apr 2017 00:56:00 GMT

@mholden37 - Did one of the answers below help provide a solution your question? If yes, please click “Accept” below the best answer to resolve this post and upvote anything that was helpful. If no, please leave a comment with more feedback. Thanks.