topic search time an hour plus in Splunk Search

search time an hour plus

adcom26 — Thu, 27 Aug 2020 14:23:26 GMT

Hello

when i make a search i got an hour plus

Re: search time an hour plus

gcusello — Thu, 27 Aug 2020 14:27:36 GMT

did you checked the timezone of the data source or the solar time, probably it's different than the one of your Splunk server.

Ciao.

Giuseppe

Re: search time an hour plus

adcom26 — Thu, 27 Aug 2020 14:34:08 GMT

I checked it. But is the same

Re: search time an hour plus

gcusello — Thu, 27 Aug 2020 14:42:23 GMT

Hi @adcom26,

the one hour delay is continue or not? in other words: have you alwaus one hur delay or in some moments there's a delay of less than one hour?

if it isn't continue, see how the data are generated: if there's a script or how are generated the written files, because maybe there a delay in generation or copy.

If instead you have a continue delay of exactly one hour this is usually a timezone problem, see in the raw events if the timestamp of the event is the same of the time in the events, if it's the same check what's the real timezone of the data, if it's different, check the props.conf of your sourcetype.

Ciao.

Giuseppe

Re: search time an hour plus

adcom26 — Thu, 27 Aug 2020 14:52:25 GMT

HI @gcusello

the one hour delay is continue

Re: search time an hour plus

gcusello — Wed, 02 Sep 2020 06:23:33 GMT

Hi @adcom26,

as I said, check if the server has the correct time, maybe it hasn't the solar time.

Ciao.

Giuseppe

Re: search time an hour plus

gcusello — Fri, 28 Aug 2020 12:30:59 GMT

Hi @adcom26,

you haven't to check the Splunk server time that's correct, but the server that's sending logs, probably it has a different time.

Ciao.

Giuseppe