topic Difference Between Event Time and _time in Splunk Search

Difference Between Event Time and _time

kirchoffbk — Sun, 27 Dec 2020 16:42:29 GMT

Hi all,

I have a problem about _time field. There is difference between event in time and _time field. Like below,

Wrong Time: 12/28/20 6:34:28 AM

Correct Time: 12/27/2020 07:34:28 PM

Do you have any idea about it?

kirchoffbk — Sun, 27 Dec 2020 21:46:44 GMT

It fixed after setting ntp&reboot on Windows

richgalloway — Sun, 27 Dec 2020 21:50:47 GMT

There are a few possible explanations.

Your selected time zone does not match the time zone of the system that produced the event.
The time field in the event does not have a time zone indication so Splunk assumed the time is in the Splunk server's time zone.
The time field in the event does have a time zone indicator, but the TIME_FORMAT attribute in props.conf does not account for it.
The TZ attribute in props.conf is not set correctly.
The clock on the originating system is incorrect.