Getting Data In

After daylight savings some timestamp errors

chlima
Explorer

Hi everyone!

From the beginning of daylight savings, every event indexed by 1 hour, got a wrong timestamp, something like "0:00:00 1-1-1970".

It's the second time that I got this problem but I didn't found any answer and solution for this.

Do you know if it's a bug and how to workarround this ?

Thanks you all!

0 Karma

sudosplunk
Motivator

@chlima,

Did you explicitly configure timestamp extraction using props.conf? If yes, can you share sample events and your configuration settings(props.conf) for timestamp extraction.

0 Karma

chlima
Explorer

I didn't set it in props.conf.
Since I receive a lot event types (sourcetypes), should I configure it for each host by sourcetype?
There is a way to do it globally?
Thank you.

0 Karma

sudosplunk
Motivator

Yes, it is suggested that you configure timestamp extractions and other settings by sourcetype (in props.conf).
No, you need not configure this by host as long as data from all hosts have the same sourcetype (run this to find out: index=idx sourcetype=your_sourcetype | stats values(host) by sourcetype)
Please paste some sample events and tell us the expected output.

0 Karma

msivill_splunk
Splunk Employee
Splunk Employee
0 Karma

chlima
Explorer

Hello!
There is a way to do it globally (for all hosts)?
Thank you.

0 Karma

msivill_splunk
Splunk Employee
Splunk Employee

On the event coming in is there a timezone as part of the timestamp?

0 Karma

chlima
Explorer

Thank you for your answer.

I didn't check out all events, but i can say most does not have TZ.

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Avoid Certificate Expiry Issues in Splunk Enterprise with Certificate Assist

This blog post is part 2 of 4 of a series on Splunk Assist. Click the links below to see the other ...

Using Machine Learning for Hunting Security Threats

REGISTER NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more ...