Getting Data In

How can we use original timestamps with distributed search indexers

fox
Path Finder

Architecture: Two splunk servers: 1. London as search and local indexing. 2. New York as local indexing only.

The events in question have the correct timestamp in the log file and it has been established when searched on each of the local indexers that the correct timestamp (ie that of the local time) has been indexed correctly

When searching for New York events on the London server, the New York events seem to be getting automatically adjusted in the search results- this we don't want. We know that all events are indexed with the correct timestamp. How can we use the timestamps that we have in the raw indexes?

0 Karma

Rob
Splunk Employee
Splunk Employee

I am assuming that you do not want to use the Splunk time extractor which extracts the logged timestamp and "normalizes" it according to time zones at all? In which case you will want to edit/create the props.conf file in $SPLUNK_HOME/etc/system/local/ with the following stanza:

[default]
DATETIME_CONFIG = NONE

This will turn off all the time adjustments. You can also set the option to "CURRENT" which will insert the current system time or you can take a look at the datetime.xml file which Splunk uses for the conversion.

There are some other options for configure time zones which you can find here.

For information about Splunk timestamp recognition, you can check out the docs here.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...