topic Re: After daylight savings some timestamp errors in Getting Data In

After daylight savings some timestamp errors

chlima — Tue, 23 Oct 2018 13:47:34 GMT

Hi everyone!

From the beginning of daylight savings, every event indexed by 1 hour, got a wrong timestamp, something like "0:00:00 1-1-1970".

It's the second time that I got this problem but I didn't found any answer and solution for this.

Do you know if it's a bug and how to workarround this ?

Thanks you all!

Re: After daylight savings some timestamp errors

msivill_splunk — Tue, 23 Oct 2018 16:19:52 GMT

On the event coming in is there a timezone as part of the timestamp?

Re: After daylight savings some timestamp errors

chlima — Wed, 24 Oct 2018 21:21:55 GMT

Thank you for your answer.

I didn't check out all events, but i can say most does not have TZ.

Re: After daylight savings some timestamp errors

msivill_splunk — Thu, 25 Oct 2018 07:14:42 GMT

This answer may provide some pointers for you

https://answers.splunk.com/answers/241990/does-splunk-take-into-consideration-timezone-dayli.html

Re: After daylight savings some timestamp errors

sudosplunk — Thu, 25 Oct 2018 13:49:58 GMT

@chlima,

Did you explicitly configure timestamp extraction using props.conf? If yes, can you share sample events and your configuration settings(props.conf) for timestamp extraction.

Re: After daylight savings some timestamp errors

chlima — Mon, 29 Oct 2018 12:10:10 GMT

I didn't set it in props.conf.
Since I receive a lot event types (sourcetypes), should I configure it for each host by sourcetype?
There is a way to do it globally?
Thank you.

Re: After daylight savings some timestamp errors

chlima — Mon, 29 Oct 2018 12:11:48 GMT

Hello!
There is a way to do it globally (for all hosts)?
Thank you.

Re: After daylight savings some timestamp errors

sudosplunk — Mon, 29 Oct 2018 12:17:59 GMT

Yes, it is suggested that you configure timestamp extractions and other settings by sourcetype (in props.conf).
No, you need not configure this by host as long as data from all hosts have the same sourcetype (run this to find out: index=idx sourcetype=your_sourcetype | stats values(host) by sourcetype)
Please paste some sample events and tell us the expected output.