topic Re: Index timestamp off by an hour in Getting Data In

Index timestamp off by an hour

atulmistry — Wed, 01 Sep 2010 01:09:50 GMT

I'm having an issue where the timestamp for an event is presented one hour in the past.

ex: for the following event produced on the splunk server:

20100831173739.374286
AvailableMBytes=1146
CommittedBytes=979374080
PagesPersec=12
PercentCommittedBytesInUse=21
wmi_type=Memory

i'm seeing the following time for the event on the web interface:

8/31/2010 4:37:39.3742

it should be 8/31/2010 5:37:39:372

some notes:

This event is produced on the server same server that is running splunk
i'm seeing this effect on all events (windows event log, other wmi, etc.)
this is a windows environment. running windows 2008 with time zone set to GMT.

any thoughts?

Re: Index timestamp off by an hour

gkanapathy — Wed, 01 Sep 2010 01:26:08 GMT

Is the time zone set to GMT, or is the time zone set to "GMT: London,Dublin" or whatever the Windows interface calls it, or is it set to "GMT: Coordinated Universal Time"? During the summer, London is on British Summer Time, and the Windows UI is not clear that there is a difference between real GMT and London time.

Nevertheless there is probably a bug in Splunk in that Splunk indexing seems to think that your machine is on "real" GMT, when in fact it's on British Time which switches between GMT and BST, and so does not make the appropriate adjustment when it stores the timestamps internally. It's likely/possible that Splunk indexing suffers from that same confusion as Windows probably presents a confusing time zone name to the APIs as well. At the same time, when times are displayed to the user, they are probably correctly converted according to the current offset of the display timezone. Or maybe it's the other way around.

Re: Index timestamp off by an hour

atulmistry — Wed, 01 Sep 2010 18:47:18 GMT

i had it set to GMT: Dublin, Edinburgh, Lisbon, London with the daylight saving flag turned off. i changed it to GMT: Monrovia, Reykjavik and that resolved my issue. Thanks,

Re: Index timestamp off by an hour

gkanapathy — Wed, 01 Sep 2010 21:16:17 GMT

Ah, then the problem is that Splunk probably just looks at the time zone name/description, and ignores the DST flag.

Re: Index timestamp off by an hour

LBG_Ankit — Tue, 18 Sep 2018 12:31:34 GMT

Hi Atul,

can you please let em know what props u have used to resolve this issue.
My issue is something like that, the logs are coming one hour delay(index time) from the venet generated time. And I need to change it to GMT+1 for BST as we are in BST currently?

Thanks,
Ankit