Getting Data In

Index timestamp off by an hour

Engager

I'm having an issue where the timestamp for an event is presented one hour in the past.

ex: for the following event produced on the splunk server:

20100831173739.374286
AvailableMBytes=1146
CommittedBytes=979374080
PagesPersec=12
PercentCommittedBytesInUse=21
wmi_type=Memory

i'm seeing the following time for the event on the web interface:

8/31/2010 4:37:39.3742

it should be 8/31/2010 5:37:39:372

some notes:

  • This event is produced on the server same server that is running splunk
  • i'm seeing this effect on all events (windows event log, other wmi, etc.)
  • this is a windows environment. running windows 2008 with time zone set to GMT.

any thoughts?

Tags (1)
0 Karma
1 Solution

Splunk Employee
Splunk Employee

Is the time zone set to GMT, or is the time zone set to "GMT: London,Dublin" or whatever the Windows interface calls it, or is it set to "GMT: Coordinated Universal Time"? During the summer, London is on British Summer Time, and the Windows UI is not clear that there is a difference between real GMT and London time.

Nevertheless there is probably a bug in Splunk in that Splunk indexing seems to think that your machine is on "real" GMT, when in fact it's on British Time which switches between GMT and BST, and so does not make the appropriate adjustment when it stores the timestamps internally. It's likely/possible that Splunk indexing suffers from that same confusion as Windows probably presents a confusing time zone name to the APIs as well. At the same time, when times are displayed to the user, they are probably correctly converted according to the current offset of the display timezone. Or maybe it's the other way around.

View solution in original post

Splunk Employee
Splunk Employee

Is the time zone set to GMT, or is the time zone set to "GMT: London,Dublin" or whatever the Windows interface calls it, or is it set to "GMT: Coordinated Universal Time"? During the summer, London is on British Summer Time, and the Windows UI is not clear that there is a difference between real GMT and London time.

Nevertheless there is probably a bug in Splunk in that Splunk indexing seems to think that your machine is on "real" GMT, when in fact it's on British Time which switches between GMT and BST, and so does not make the appropriate adjustment when it stores the timestamps internally. It's likely/possible that Splunk indexing suffers from that same confusion as Windows probably presents a confusing time zone name to the APIs as well. At the same time, when times are displayed to the user, they are probably correctly converted according to the current offset of the display timezone. Or maybe it's the other way around.

View solution in original post

Splunk Employee
Splunk Employee

Ah, then the problem is that Splunk probably just looks at the time zone name/description, and ignores the DST flag.

0 Karma

Engager

i had it set to GMT: Dublin, Edinburgh, Lisbon, London with the daylight saving flag turned off. i changed it to GMT: Monrovia, Reykjavik and that resolved my issue. Thanks,

0 Karma

New Member

Hi Atul,

can you please let em know what props u have used to resolve this issue.
My issue is something like that, the logs are coming one hour delay(index time) from the venet generated time. And I need to change it to GMT+1 for BST as we are in BST currently?

Thanks,
Ankit

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!