topic Re: Splunk - Adjusting source file timestamp in Getting Data In

Splunk - Adjusting source file timestamp

nageshkumarapp — Tue, 29 Sep 2020 15:40:50 GMT

Given:
I have two log files (file_1, file_2)
Each from a different server (server_1, server_2).
The servers are not property synchronized via ntpd. (Example: server_1 is 13 seconds ahead of server_2.)
I do not have the ability to adjust or correct the server times.
I am the Splunk user, not the Splunk administrator.

Problem: After ingesting each of the log files, the events are off by 13 seconds (obviously).

Question: Can I adjust the _time for all events in source=file_2 by 13 seconds so the events line up correctly in search results, graphs, etc.?

Re: Splunk - Adjusting source file timestamp

jkat54 — Tue, 29 Sep 2020 15:40:55 GMT

You can do it in search like this:

  ...| eval _time=if(host=server_2,_time+13,_time) | convert ctime(_time)

_time equals (if server_2, add 13s to_time, else use _time)

The eval will end up changing _time to epoch in visualizations... add the convert to swap it back to human readable format.

You can do it in search time props like this (maybe, just not sure if it works with _time)

 [host::server_2]
 EVAL-_time = _time+13

Cheers,
JKAT

Re: Splunk - Adjusting source file timestamp

cpetterborg — Fri, 08 Sep 2017 15:24:57 GMT

You will have to regularly check the time drift and update accordingly (or automate it) because unchecked system time will continue to drift further

You COULD also use the index_time instead of _time for your searching, though that could have a little bit of latency (but hopefully not 13 seconds worth). That won't require the updating of the time drift.

Re: Splunk - Adjusting source file timestamp

jkat54 — Sun, 10 Sep 2017 12:07:51 GMT

I concur!!!