splunk time problem

[aalaa]

Hello ,

We have a problem between the time of the splunk and the time of the events cisco probably :

We create a real-time alert about changing the status of switches or routers interfaces.

Based on dashboards at the Cisco Network application :

Search = "sourcetype =" cisco: ios "src_int! =" "Host =" * "| stats count by _time, host, src_int, port_status | where port_status =" up "OR port_status =" down "

We create this alert to send each email the port status change from "UP to down" or "down to UP" in real time.

I have tested several times changing the status of a switch interface but i don't receive any triggered alert , according to the support analysis we observed that the problem is in the difference between the time of the splunk and the time of the events cisco not in the configuration of the alert .

Lastes event cisco : 10:03
Time splunk : 09:03

So any help please ?

[gcusello]

Hi aalaa,
probably there's a timezone problem: on cisto you have summer time and not in Splunk, you havew to adjust the timezones.
Bye.
Giuseppe