Dashboards & Visualizations

Splunk dashboard does not pick the correct timestamp to display data

prajnaamey
Engager

Hello, 

I am streaming a list of data with the most recent timestamp, but the data is getting displayed in a different time.  For example:

t=1632967410.582567 devicename=abc Ethernet.dst=### Ethernet.src=### Ethernet.type=65535
t=1632967410.582567 devicename=abc Ethernet.dst=### Ethernet.src=### Ethernet.type=65535
t=1632967410.582567 devicename=abc Ethernet.dst=### Ethernet.src=### Ethernet.type=65535 

The Epoch conversion of the above timestamp (t=1632967410.582567 ) is 7:03:30.582 PM but the data on the dashboard is displayed at time 5:19:01.000 PM 

Background:
* Data is generated from a python script, the data is a list of events, and each event is printed to stdout
* I have tried to include additional line breaks between each event, but it still streams it as a single chunk and displays it in a different timestamp
* The version of SUF is 8.2.1 (build - ddff1c41e5cf) 
* The version of Splunk Enterprise is 8.1.2

Can someone guide me on fixing this to print the streamed data in the correct timestamp? 

Thank you.

Labels (4)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Are you looking to break up the events in SPL or at ingest time?

0 Karma

prajnaamey
Engager

Hi @ITWhisperer we want to break the events at ingest time and not at the search level. Ideally, we want it at the SUF level (data generation stage) as we do not have access to all the Splunk servers for any server-level modifications. 

0 Karma

SanjayReddy
SplunkTrust
SplunkTrust

Hi @prajnaamey 

you can try with strftime function to convert epoch time to human redable format

https://docs.splunk.com/Documentation/Splunk/8.2.2/SearchReference/DateandTimeFunctions#strftime.28X... 

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...