topic Re: Time Log always add 7 hours in Getting Data In

Time Log always add 7 hours

sianty910 — Thu, 12 Apr 2018 06:56:27 GMT

hello, i"m a newbie in splunk.
i try to display my log file on splunk, but i had a issue here.

this in example for my log file :
2018 Apr 12 13:03:00:000 GMT +0700 Test14

but the displayed time is always added with 7 hours.

can anyone help me?
thanks

Re: Time Log always add 7 hours

sianty910 — Tue, 29 Sep 2020 18:59:07 GMT

for info, i've already tried using this config on my props.conf but it no works :

TZ = GMT
TIME_PREFIX = ^
TIME_FORMAT = %Y %b %d %H:%M:%S:%3N
MAX_TIMESTAMP_LOOKAHEAD = 24

Re: Time Log always add 7 hours

damien_chillet — Thu, 12 Apr 2018 12:36:58 GMT

Try to change your timezone in your Account Settings. You must be using GMT and since the event is GMT +7000, Splunk is adjusting the timestamp to your timezone.

Re: Time Log always add 7 hours

sianty910 — Thu, 12 Apr 2018 13:21:08 GMT

Hi. i've already tried to change my timezone to GMT + 07.00 but still no changes on mu log display.

Re: Time Log always add 7 hours

damien_chillet — Thu, 12 Apr 2018 13:25:22 GMT

Did you have timezone information in your original props.conf?

TIME_FORMAT = %Y %b %d %H:%M:%S:%3N %Z %z

Re: Time Log always add 7 hours

sianty910 — Tue, 29 Sep 2020 18:59:50 GMT

for using this time format with timezone (%Z), i have to increase the MAX_TIMESTAMP_LOOKAHEAD to 34, right?

i've already tried it also. and still no changes.

my props.conf :
TZ = GMT
TIME_PREFIX = ^
TIME_FORMAT = %Y %b %d %H:%M:%S:%3N %Z %z
MAX_TIMESTAMP_LOOKAHEAD = 34

did i miss something?

Re: Time Log always add 7 hours

damien_chillet — Fri, 13 Apr 2018 10:36:16 GMT

You will need to reindex the file to see changes though.
Also you can remove TZ since we get timezone from TIME_FORMAT.

Re: Time Log always add 7 hours

pruthvikrishnap — Thu, 21 Jun 2018 21:00:59 GMT

Try this in your props:

[source::.../*.log]
TIME_PREFIX = ^
TIME_FORMAT = %b %d %H:%M:%S
MAX_TIMESTAMP_LOOKAHEAD = 16
TZ = Etc/GMT+7