How to configure the Splunk Add-on for Netflow or indexer to capture the correct time stamp for Netflow log data?

[jeffrey2015]

Running the Splunk Add-on for Netflow on a Linux server so it can translate the data and forward it to our main Splunk instance running on Windows. The Netflow data on the Linux box looks something like this for date and time:

1969-12-31 19:00:00,1969-12-31 19:00:00,0.000

This then gets sent over to our indexer (Windows box) and it stamps it with the right date, but the time it stamps it with is 7PM. What can I adjust in the Netflow add-on or on the indexer to get it to stamp it with the correct times?

[thejohn]

I encountered this same issue when collecting Netflow v9. However, when using v5, it sets the correct timestamp. I think there's an issue with nfdump that comes with this add-on.

[ehaddad_splunk]

Hi
Do you mean you want the time to show in 24h clock instead 12h clock? in other words in your example that would be 19:00 instead of 7PM?
If this is the case you can do so by changing the locale. Here are some useful links:
https://answers.splunk.com/answers/10643/time-format-for-results-in-en-us-vs-en-gb.html
https://answers.splunk.com/answers/12509/possible-to-set-user-interface-to-show-24-clock.html

[jeffrey2015]

No, it is more like the time itself is way off the line above was captured about 30 minutes ago. The correct time should have been 1:07PM EST.