Just installed the REST API Modular Input and love it so far, but I'm having 1 major issue. The timestamp on all of my events from this module are 1 hour ahead of my current time. Anything I can do to fix this? It's breaking the relative search in my dashboard.
Found it. Pretty stupid of me, I didn't realize the json from the web api ad a datetime in it and it's 1 hour off.
Found it. Pretty stupid of me, I didn't realize the json from the web api ad a datetime in it and it's 1 hour off.
You can tell splunk to use its own time for _time and not try and look it up in the event, but I would recommend just fixing the source if you can for accuracy.
Are you referring to the _time field?
Yes, _time. My other inputs are showing correct time but the REST and Command apps aren't. Couldn't find any reference to a TZ change in any prop.confs. No idea where to look now. Even read through the python script and all it does is return the json strong.