Getting Data In

How do I fix this error: One or more sourcetypes has been found to present events in the future

Mohanveera1
Explorer

Hello everyone,

In Splunk GUI when i run health check its showing one error like One or more source types has been found to present events in the future. All the sources are giving the correct timestamp with timezone UTC +0:00 but when i checked the devices that are configured with the source types with the error, the devices are in the other timezone i.e UTC +08:00, and we are receiving the logs that are also in the future timezone. so how can i overcome this problem with the future timestamp. the Splunk indexer time zone is UTC +0:00 please refer the screenshot.

Mohanveera1_0-1654071944547.png

Thanks in advance............

0 Karma

venky1544
Builder

HI @Mohanveera1 

it could be that  the timestamp extraction for this sourcetype in the props.conf might be ignoring the time zone specifier probably you might want to consider using theTimezone(TZ) attribute if the event time stamp does not have  a time zone

would you mind sharing the props configuration for this sourcetype

 

Note: if it helps karma points are appreciated/if it resolves acceptance of the solution is appreciated 

0 Karma

Mohanveera1
Explorer

Hi @venky1544 

 

Thank you for your response.

The events are having the timestamp and the devices from which the events are generating are in other time zone i.e +08:00 UTC. But the splunk time zone is +0:00 UTC.

I have searched for the props.conf for the specific sourcetype which are getting the future timestamp error. but there was no file available.

the path where is searched for the props.conf is Splunk home/etc/apps/apacinfoblox/local. so please suggest me the way to solve the issue.

0 Karma
Get Updates on the Splunk Community!

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...