Force Windows app to use extracted time, not index time

[alekksi]

Hi all,

I am using the Splunk to monitor some Windows servers using the perfmon input of the Windows app. I am having difficulty with the event time and the index time, as it is completely disregarding the time in the raw event and just using the time when it arrives at the indexer. This is a bit frustrating as it can be indexing things (assuming a restart or similar) a minute or so after the event actually taking place.

I've tried a few different things -- changed a server from BST to GMT, changed the region settings on that server to English (US), added "TZ = Europe/London" to props.conf on both the indexers -- both in one of the apps and in etc/system/local, modified datetime.xml to swap the European and American datetimes and referenced it on the indexer and in the app using DATETIME_CONFIG, and also set DATETIME_CONFIG to NONE.

I am a bit at my wit's end -- how do I force this to read the event time, rather than using the indextime?

Thanks and regards,
Alex

[derekarnold]

What could be happening is Splunk is searching your log file for a timestamp, but coming up blank because your timestamp isn't matching a criteria it recognizes. If there's a lack of a coherent timestamp to find Splunk will stamp it at index time.
There are some best practices posted here:

http://dev.splunk.com/view/logging-best-practices/SP-CAAADP6

If you don't have control over the timestamp and it's non-standard you will have to train Splunk how to look for the timestamp in props.conf for your app. Here's a reference for how to do so.

http://docs.splunk.com/Documentation/Splunk/6.1.1/Admin/Propsconf

If you want post the timestamp verbatim here and perhaps it will shed light on the issue.

[alekksi]

Unfortunately Splunk should recognise the timestamp as it is an officially supported app.

Thanks for the response, but I have binned all the work I have done using the Splunk App for Windows Infrastructure and have developed my own solution.