topic Re: What time is displayed in raw splunk logs in Getting Data In

What time is displayed in raw splunk logs

gsonal03 — Sat, 16 Mar 2019 16:54:17 GMT

I am trying to debug issues related to delay in splunk forwarding or indexing in a separate splunk query "https://answers.splunk.com/answers/730136/why-are-our-splunk-indexes-not-showing-all-log-ent.html. But I would like to understand how the display of raw logs are governed, so opening a new ticket.

Attached below is a mockup of how I see logs in raw format and account settings. I have my account settings configured to GMT timezone. When I search any logs in raw format, I see each log entry beginning with EST timestamp. When I expand it, I see _time field showing time in GMT format.
How and where can I change the settings for the log entry so that it remains consistent and I can debug correct time period to view logs . The servers from where we are forwarding the logs is also in GMT time as far as I know.
Time-mockup:

Re: What time is displayed in raw splunk logs

woodcock — Sat, 16 Mar 2019 17:32:34 GMT

There is no such thing as time displayed in logs; there is only text displayed in logs so the thing that you see in the raw event is the unmodified text the way that the event came in.

Do you see the Raw v that is above Event that is above your timestamp?
Click on that and change it to List. You will then see a new column called Time between i and Event that shows the event's timestamp adjusted to your user's Time zone setting. BTW, List is the default so at some point you changed this (or somebody logged in as you), so don't blame Splunk!

Re: What time is displayed in raw splunk logs

gsonal03 — Sat, 16 Mar 2019 17:48:10 GMT

Thanks for the explanation. I am not blaming splunk for anything, just trying to understand so it can utilized in correct manner.
With the explanation you are giving, it seems the source log file is logging in EST, that would mean the server which I assumed was in GMT is in fact in EST location. So, I need to change my account settings to EST then, to get consistent logs.
I will try this and see if it helps in finding old logs in appropriate date time range.

Re: What time is displayed in raw splunk logs

woodcock — Sat, 16 Mar 2019 17:50:59 GMT

You've got it.