SearchHead with different times (_time)

[isac_santana]

Good morning,

I need help. I have three SearchHead servers.

Two of them (SH1 and SH2) are presenting the "_time" field correctly. However, the other server (SH3) is presenting the "_time" field with three hours more than the other two (SH1 and SH2).

How do I resolve this?


SH2 - Normal

SH3 - With three more hours. (With same search range)

[pavinic · Accepted solution]

Siga os comandos abaixo no linux, compare com os servidores existentes, e aplique o timezone desejado

# MUDAR TIMEZONE DO SERVICOR via linux

# identifica timezone do servidor

timedatectl

# lista os timezones

timedatectl list-timezones

# configura o timezone desejado

sudo timedatectl set-timezone America/Sao_Paulo

[dural_yyz]

Are the search heads in the same time zone, are they configured for the same time zone?

Are the user profiles set to the appropriate time zone?

There are a lot of factors at play here and mostly to do with local configurations which you haven't confirmed yet.

[isac_santana]

Hey, good afternoon.

The configurations on these servers weren't done by me, and I have limited knowledge of Splunk administration. That’s why it's been challenging to identify where the "_time" discrepancy is coming from.

• The search query is exactly the same, retrieving the same data within the same time range.

• The user’s timezone is set to "Default System TimeZone."

• I believe all the SHs are also set to "Default System TimeZone" (although it’s been difficult to confirm this information).

SH1 and SH2 are older servers, while SH3, which shows the difference in "_time," is a recently installed and configured server within the cluster (also configured by someone else).