topic Re: Event time and index time in Getting Data In https://community.splunk.com/t5/Getting-Data-In/How-to-resolve-latency-between-event-time-and-index-time/m-p/507628#M86389 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/213957">@richgalloway</a>&nbsp;event time is CDT. So what i need to do.</P> Mon, 06 Jul 2020 17:06:16 GMT LogUx 2020-07-06T17:06:16Z How to resolve latency between event time and index time? https://community.splunk.com/t5/Getting-Data-In/How-to-resolve-latency-between-event-time-and-index-time/m-p/507620#M86386 <P>My index time is 7/6/20 3:37:42.210 PM&nbsp;</P> <P>My event time is 07/06/20 10:37:42.210 CDT</P> <P>My TIME_FORMAT=%x %H:%M:%S.%3N%Z</P> <P>But still, by referencing the above time, we can see the latency between index time and event time. Please suggest how to resolve this.</P> Mon, 06 Jul 2020 19:14:13 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-resolve-latency-between-event-time-and-index-time/m-p/507620#M86386 LogUx 2020-07-06T19:14:13Z Re: Event time and index time https://community.splunk.com/t5/Getting-Data-In/How-to-resolve-latency-between-event-time-and-index-time/m-p/507627#M86388 Is the index time in UTC or CDT? If the former, then there's no latency.<BR />If the event time is in CDT then you have a latency of exactly 5 hours, which usually indicates a time zone setting error. Mon, 06 Jul 2020 16:58:59 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-resolve-latency-between-event-time-and-index-time/m-p/507627#M86388 richgalloway 2020-07-06T16:58:59Z Re: Event time and index time https://community.splunk.com/t5/Getting-Data-In/How-to-resolve-latency-between-event-time-and-index-time/m-p/507628#M86389 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/213957">@richgalloway</a>&nbsp;event time is CDT. So what i need to do.</P> Mon, 06 Jul 2020 17:06:16 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-resolve-latency-between-event-time-and-index-time/m-p/507628#M86389 LogUx 2020-07-06T17:06:16Z Re: Event time and index time https://community.splunk.com/t5/Getting-Data-In/How-to-resolve-latency-between-event-time-and-index-time/m-p/507632#M86391 Verify the source system has its time zone set correctly.<BR />Verify the data source is sending the right timestamps.<BR />Consider changing the TIME_FORMAT setting to drop the "%Z". Mon, 06 Jul 2020 17:20:35 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-resolve-latency-between-event-time-and-index-time/m-p/507632#M86391 richgalloway 2020-07-06T17:20:35Z Re: Event time and index time https://community.splunk.com/t5/Getting-Data-In/How-to-resolve-latency-between-event-time-and-index-time/m-p/507640#M86395 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/213957">@richgalloway</a>&nbsp; Yes i will check, please let me know if source system and that source system logs are different timestamps, then it will create any latency ? And how to solve that?</P> Mon, 06 Jul 2020 17:39:10 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-resolve-latency-between-event-time-and-index-time/m-p/507640#M86395 LogUx 2020-07-06T17:39:10Z Re: Event time and index time https://community.splunk.com/t5/Getting-Data-In/How-to-resolve-latency-between-event-time-and-index-time/m-p/507644#M86396 Splunk indexes events as soon as they are received. An incorrect timestamp may generate a warning message, but will not cause index latency.<BR />However, an incorrect TIME_FORMAT setting can cause Splunk to mis-interpret a timestamp and index it incorrectly, thus creating the appearance of latency. Mon, 06 Jul 2020 17:53:34 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-resolve-latency-between-event-time-and-index-time/m-p/507644#M86396 richgalloway 2020-07-06T17:53:34Z Re: Event time and index time https://community.splunk.com/t5/Getting-Data-In/How-to-resolve-latency-between-event-time-and-index-time/m-p/507894#M86437 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/213957">@richgalloway</a>&nbsp;So you want me to use only&nbsp;<SPAN>TIME_FORMAT=%x %H:%M:%S.%3N and remove %Z?</SPAN></P> Tue, 07 Jul 2020 17:53:40 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-resolve-latency-between-event-time-and-index-time/m-p/507894#M86437 LogUx 2020-07-07T17:53:40Z Re: Event time and index time https://community.splunk.com/t5/Getting-Data-In/How-to-resolve-latency-between-event-time-and-index-time/m-p/507900#M86440 If the timestamp in the event does not contain a time zone indication (or contains the wrong one) then "%Z" should not be part of TIME_FORMAT. Tue, 07 Jul 2020 18:58:54 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-resolve-latency-between-event-time-and-index-time/m-p/507900#M86440 richgalloway 2020-07-07T18:58:54Z