Getting Data In
Highlighted

How to fix an incorrectly indexed timestamp?

Engager

Splunk is not showing the correct time on the events. The time that Splunk gives the log is 5 hours behind the time that it is supposed to be. The time is correct on the server and the logs but Splunk is saying it is 5 hours behind. For the below timestamp it is giving it a time of 8:48:06.000 AM when it should be 1:48:06.000PM.

2017-02-22T13:48:06Z

In props.conf I have TIME_FORMAT=%Y-%m-%dT%H:%M:%SZ

I have also tried changing the timezone to TZ = UTC and that did not fix it.

0 Karma
Highlighted

Re: How to fix an incorrectly indexed timestamp?

SplunkTrust
SplunkTrust

If your Splunk is in the US eastern time zone then 13:48:06Z correctly converts to 08:48:06 EST. The "Z" says the timestamp is in UTC so Splunk converts it to the local time zone. If that is not the expected behavior then change the server to specify the correct time zone in its events.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

Highlighted

Re: How to fix an incorrectly indexed timestamp?

Ultra Champion

What happens when you set the time to be parsed automatically?
Alternatively, try using the strptime to validate the string parsing.
For example, you could also try %FT%TZ as per https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Commontimeformatvariables

0 Karma
Highlighted

Re: How to fix an incorrectly indexed timestamp?

Influencer

@mholden37 - Did one of the answers below help provide a solution your question? If yes, please click “Accept” below the best answer to resolve this post and upvote anything that was helpful. If no, please leave a comment with more feedback. Thanks.

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.