Splunk taking wrong time from logs

ajaylowes — Sat, 30 Sep 2017 19:23:00 GMT

Splunk adds one hour to timestamp, when indexing logs.

Logs:
9/18/17 3:46:01.000 PM --> time splunk shows
[][hello][please][help][18/Sep/2017:14:46:01 -0500] --> actual log

I have added the below in my props.conf
[host::xyz*]
TZ = US/Eastern

Also tried TZ = America/New_York ( GMT -5:00)

Server shows this date - Sat Sep 30 15:22:18 EDT 2017

Re: Splunk taking wrong time from logs

acharlieh — Sat, 30 Sep 2017 20:21:49 GMT

Assuming that your user is set to Eastern time, then the display of _time in Splunk is correct for what your log has printed:

Your log explicitly states that it's "14:46 UTC-5" which is 15:46 (or 3:46p) in US/Eastern right now (Remember... EDT is UTC-4).

It could be your log is printing the wrong UTC offset, assuming that event you have there actually was at 14:46 EDT instead of 14:46 -0500 You may want to compare the delta of _time and _indextime to figure out if you have an issue there or not.

The explicit time zone in the log takes precedence when determining time zone: https://docs.splunk.com/Documentation/Splunk/7.0.0/Data/Applytimezoneoffsetstotimestamps

topic Splunk taking wrong time from logs in Splunk Search

Splunk taking wrong time from logs

Re: Splunk taking wrong time from logs