topic Re: different timestamp displayed in log file than splunk timestamp in Getting Data In

different timestamp displayed in log file than splunk timestamp

ravinder82 — Sat, 29 Jun 2013 13:32:39 GMT

Hi Team,

i am facing the issue of different timezones. Splunk timezone is CET but log event timezone is coming as UTC in my localhost access logs but other log event are displaying the timezone in sync with CET timezone.

Splunk timestamp is 6/11/13 11:31:44:000 AM
Event log timestamp is [11/Jun/2013:09:31:44 +0000]

I need event timestamp in CET timezone. Is there any way to do it in search query by making offset of 2 hours

Kindly help.

Thanks

Re: different timestamp displayed in log file than splunk timestamp

martin_mueller — Sat, 29 Jun 2013 14:49:50 GMT

You can set a timezone by host or sourcetype when indexing to get the timestamps correct right away: http://docs.splunk.com/Documentation/Splunk/5.0.3/data/Applytimezoneoffsetstotimestamps

Re: different timestamp displayed in log file than splunk timestamp

kristian_kolb — Sat, 29 Jun 2013 18:34:08 GMT

eeh, it seems like this is handled correctly. You are in CET, and the events that have timestamps set in another zone gets this 'corrected', thus the 2 hour difference.

Re: different timestamp displayed in log file than splunk timestamp

ravinder82 — Sat, 29 Jun 2013 21:04:39 GMT

Thanks Martin for the information.

But problem with me is i am not admin of Splunk portal. It is configured and maintained by third party. Hence i cant change the settings and hard to convince them as timezone in other source files like error logs, catalina.out logs are in CET timezone which is correct.

Only localhost log access event are in different timezone as i posted.

Is there any way to correct the timezone to CET only in splunk search query.

Thanks

Re: different timestamp displayed in log file than splunk timestamp

martin_mueller — Sat, 29 Jun 2013 21:13:17 GMT

Once indexed, you cannot change the events.
Searching through an extra two hours, recalculating the timestamp, and re-filtering mid-search is not a great idea either - apart from lost performance that's a horrible pitfall for errors and a maintenance nightmare.

Get things indexed correctly, even if it may involve some convincing of third parties.