What timezone does collect use?

khevans — Sun, 07 Jun 2020 00:01:06 GMT

There is something wrong (or not obvious from the documentation) with how collect takes timezones.

_time fields should be stored in unixtime, right?

I have a report which does a long search and I use collect to take a _time and I use addtime=t to use that _time in the new field.

The original timestamp is stored as:

2019-07-29 23:16:51.884 INFO ... in _raw (UTC). And its timestamp field is set to 2019-07-29 23:16:51.884 (UTC) and in my browser, the _time is set as 2019-07-29T16:16:51.884-07:00. That's all correct.

When I use collect and use that _time, it gets stored as 2019-07-29 23:16:51.884 in the _raw, 2019-07-29 23:16:51.884 in the timestamp field, but it incorrectly uses 2019-07-29T23:16:51.884-07:00 for _time. I don't know why it's using that timezone when it's passing the _time (which I thought was unixtime, which is always UTC).

How can I correct for this bug in Splunk?

Re: What timezone does collect use?

joesrepsolc — Wed, 03 Jun 2020 15:35:07 GMT

Seeing this exact same thing. Somehow my timestamp (_time) has -07:00 on the end of it, and this is not the timezone setting of my laptop, or the dataset (in a different timezone). Very strange indeed. Cannot find any other comments about this other than your post.

topic What timezone does collect use? in Getting Data In

What timezone does collect use?

Re: What timezone does collect use?