Getting Data In

How will Splunk handle the clock change for leap seconds in June 2012?

mctester
Communicator

See this webpage for reference - http://www.timeanddate.com/time/leapseconds.html

On June 30 2012, an extra second will be added to UTC, which will result in events with a timestamp of 'Jun 30 23:59:60' - Will Splunk recognize this as a valid timestamp?

I have multiline event log files that are broken based on the timestamp in the events, will Splunk still break the events properly?

Tags (2)
1 Solution

matt
Splunk Employee
Splunk Employee

If you are breaking events based on timestamps, that extraction should still work as the format of the timestamp will not change and that is what the linebreaking processor is interested in. What that timestamp actually means in real terms is not a consideration when identifying where to break events.

Any events containing the timestamp with a leap second will be indexed as 23:59:59, and will be searchable.

View solution in original post

ntbahriti_splun
Splunk Employee
Splunk Employee

There is an interesting wiki about the leap second at https://en.wikipedia.org/wiki/Leap_second, for those curious to better understand.

0 Karma

matt
Splunk Employee
Splunk Employee

If you are breaking events based on timestamps, that extraction should still work as the format of the timestamp will not change and that is what the linebreaking processor is interested in. What that timestamp actually means in real terms is not a consideration when identifying where to break events.

Any events containing the timestamp with a leap second will be indexed as 23:59:59, and will be searchable.

Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...