topic Re: Time Stamp Help! in Splunk Search

Time Stamp Help!

kc_prane — Wed, 14 Aug 2024 19:44:42 GMT

Hello, I have time stamps that are not matching. How do I table the actual "Event log time stamp" ?

Splunk Time stamp	Event log time stamp
8/14/24 4:29:21.000 AM	2024-08-13 17:49:23,006 [https-mmme-nio-1111-exec-2] ERROR

Re: Time Stamp Help!

isoutamo — Wed, 14 Aug 2024 19:49:32 GMT

What you have on raw event and how you have define timestamp extraction on props.conf?

Re: Time Stamp Help!

kc_prane — Wed, 14 Aug 2024 20:18:04 GMT

Hi @isoutamo, The below is the raw event. I dont have access to props.conf. so just wanted to extract the time stamp from the raw event.

2024-08-13 17:49:23,006 [https-mmme-nio-1111-exec-2] ERROR

Re: Time Stamp Help!

marnall — Wed, 14 Aug 2024 20:31:12 GMT

I indexed this log in a new sourcetype on a test machine in the GMT+2 timezone, and the timestamp seems to have extracted properly. We would need to know what your timestamp settings in props.conf are to find out where the timestamp extraction is going wrong.

Re: Time Stamp Help!

isoutamo — Wed, 14 Aug 2024 21:17:20 GMT

There seems to be probably TZ issue with some other issues with your ingestion phase. If I recall right TZ are +/- 1h or x.5h difference with local time and UTC time. But your time difference didn’t match that.

You must get your correct props.conf and also raw source event before it was ingested into splunk. With those we could help you.

Re: Time Stamp Help!

yuanliu — Thu, 15 Aug 2024 06:00:47 GMT

Hi @isoutamo, The below is the raw event. I dont have access to props.conf. so just wanted to extract

You do not need direct access to props.conf. Just use Splunk Web's Settings -> Source Types interface. There are two menus where you can customize your timestamp handling, Timestamp and Advanced.

As @isoutamo says, your problem might not be in Splunk's time extraction; instead, the apparent difference could be in time zone. If this is not the case, the best cause of action is to correct time extraction. Search time correction should only be used as the last resort. It can be done, of course.

| rex "^(?<timestamp>\S+ \S+)" | eval _time = strptime(timestamp, "%F %T,%3N")

The big problem with search time adjustment of an essential datapoint such as _time is that you lose precision when trying to set index search interval.