All Apps and Add-ons

timezone for _time is off by one hour and nothing makes sense as to why

coleman07
Path Finder

I am using eventgen to send license_usage data to a test splunk server. I looked at what was being sent and the time is set to -0700 which is Mountain Daylight time. My server on my VM is Centos 6 running on Mountain Daylight time and my Mac which has my browser is also set to Mountain Daylight time. Here is the event sent to the server:

03-31-2016 00:00:00.000002 -0700 INFO  LicenseUsage - type=RolloverSummary pool="auto_generated_pool_enterprise" slave="02AF8C6E-219F-4598-B8D5-C5D8CE74F8C7" poolsz=177167400960 b=31072775414 stack="enterprise" stacksz=177167400960

On the left side of the event list where it shows the time, it says 1:00:00.000 AM and when looking at the _time value listed when you click the left cell, it shows the time as 2016-03-31T01:00:00.000-06:00

I have no clue where the -0600 is coming from since everything is set to -0700. It is my understanding that 6.2 uses the timezone in the date if specified then the TZ variable, ... I did add a TZ variable to my props.conf file in the local app using eventgen and also in eventgen but that made no difference which makes sense since the event has -0700. Where do I look? Any clues?

1 Solution

coleman07
Path Finder

When time changes during Daylight Saving's, the computer's clock has a different numerical timezone value, i.e -0600 vs -0700. I am posting this here because others may forget this small detail which I did.

View solution in original post

0 Karma

mprreddy51
Explorer

check the latency by using this query

index=” YOURINDEXNAME” | eval indexed_time=strftime(_indextime, "%+") | eval latency=_time-_indextime|table _time,indexed_time,latency,index,source,sourcetype,_raw

and check how much delay it is in latency.If you want to make 0 latency use this (DATE_CONFIG=current) in props.conf

My guess for the difference will vary on many factors....

hope this helps

coleman07
Path Finder

When time changes during Daylight Saving's, the computer's clock has a different numerical timezone value, i.e -0600 vs -0700. I am posting this here because others may forget this small detail which I did.

0 Karma

woodcock
Esteemed Legend

You should "Accept" your answer if it is the correct(est) one and "upvote" any other answers/comments that were of assistance to you.

0 Karma

woodcock
Esteemed Legend

Splunk also normalizes YOUR time, both coming in (through the time-picker: when exactly is Yesterday?) and going out (the Time column in List mode on the Events tab) for the user's personal TZ via Your UserName -> Edit account -> Time zone. Yours probably has a value of -0600.

coleman07
Path Finder

I didn't realize when we switched to MDT , the -0700 changes to -0600. I checked date "+%z" and it is -0600 so it all makes sense. Thanks to both sideview and woodcock.

0 Karma

sideview
SplunkTrust
SplunkTrust

This may qualify me for the captain obvious hat... but this is almost certainly an inconsistency related to DST handling. Not saying it's not a bug, but that might help you narrow down where it's coming from.

Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...