Splunk dashboard does not pick the correct timestamp to display data

[prajnaamey]

Hello, 

I am streaming a list of data with the most recent timestamp, but the data is getting displayed in a different time.  For example:

t=1632967410.582567 devicename=abc Ethernet.dst=### Ethernet.src=### Ethernet.type=65535
t=1632967410.582567 devicename=abc Ethernet.dst=### Ethernet.src=### Ethernet.type=65535
t=1632967410.582567 devicename=abc Ethernet.dst=### Ethernet.src=### Ethernet.type=65535 

The Epoch conversion of the above timestamp (t=1632967410.582567 ) is 7:03:30.582 PM but the data on the dashboard is displayed at time 5:19:01.000 PM 

Background:
* Data is generated from a python script, the data is a list of events, and each event is printed to stdout
* I have tried to include additional line breaks between each event, but it still streams it as a single chunk and displays it in a different timestamp
* The version of SUF is 8.2.1 (build - ddff1c41e5cf) 
* The version of Splunk Enterprise is 8.1.2

Can someone guide me on fixing this to print the streamed data in the correct timestamp? 

Thank you.

[ITWhisperer]

Are you looking to break up the events in SPL or at ingest time?

[prajnaamey]

Hi @ITWhisperer we want to break the events at ingest time and not at the search level. Ideally, we want it at the SUF level (data generation stage) as we do not have access to all the Splunk servers for any server-level modifications. 

[SanjayReddy]

Hi @prajnaamey 

you can try with strftime function to convert epoch time to human redable format

https://docs.splunk.com/Documentation/Splunk/8.2.2/SearchReference/DateandTimeFunctions#strftime.28X...