Getting Data In

After daylight savings some timestamp errors

Explorer

Hi everyone!

From the beginning of daylight savings, every event indexed by 1 hour, got a wrong timestamp, something like "0:00:00 1-1-1970".

It's the second time that I got this problem but I didn't found any answer and solution for this.

Do you know if it's a bug and how to workarround this ?

Thanks you all!

0 Karma

Motivator

@chlima,

Did you explicitly configure timestamp extraction using props.conf? If yes, can you share sample events and your configuration settings(props.conf) for timestamp extraction.

0 Karma

Explorer

I didn't set it in props.conf.
Since I receive a lot event types (sourcetypes), should I configure it for each host by sourcetype?
There is a way to do it globally?
Thank you.

0 Karma

Motivator

Yes, it is suggested that you configure timestamp extractions and other settings by sourcetype (in props.conf).
No, you need not configure this by host as long as data from all hosts have the same sourcetype (run this to find out: index=idx sourcetype=your_sourcetype | stats values(host) by sourcetype)
Please paste some sample events and tell us the expected output.

0 Karma

Splunk Employee
Splunk Employee
0 Karma

Explorer

Hello!
There is a way to do it globally (for all hosts)?
Thank you.

0 Karma

Splunk Employee
Splunk Employee

On the event coming in is there a timezone as part of the timestamp?

0 Karma

Explorer

Thank you for your answer.

I didn't check out all events, but i can say most does not have TZ.

0 Karma