Getting Data In

Index timestamp off by an hour

atulmistry
Engager

I'm having an issue where the timestamp for an event is presented one hour in the past.

ex: for the following event produced on the splunk server:

20100831173739.374286
AvailableMBytes=1146
CommittedBytes=979374080
PagesPersec=12
PercentCommittedBytesInUse=21
wmi_type=Memory

i'm seeing the following time for the event on the web interface:

8/31/2010 4:37:39.3742

it should be 8/31/2010 5:37:39:372

some notes:

  • This event is produced on the server same server that is running splunk
  • i'm seeing this effect on all events (windows event log, other wmi, etc.)
  • this is a windows environment. running windows 2008 with time zone set to GMT.

any thoughts?

Tags (1)
0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

Is the time zone set to GMT, or is the time zone set to "GMT: London,Dublin" or whatever the Windows interface calls it, or is it set to "GMT: Coordinated Universal Time"? During the summer, London is on British Summer Time, and the Windows UI is not clear that there is a difference between real GMT and London time.

Nevertheless there is probably a bug in Splunk in that Splunk indexing seems to think that your machine is on "real" GMT, when in fact it's on British Time which switches between GMT and BST, and so does not make the appropriate adjustment when it stores the timestamps internally. It's likely/possible that Splunk indexing suffers from that same confusion as Windows probably presents a confusing time zone name to the APIs as well. At the same time, when times are displayed to the user, they are probably correctly converted according to the current offset of the display timezone. Or maybe it's the other way around.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

Is the time zone set to GMT, or is the time zone set to "GMT: London,Dublin" or whatever the Windows interface calls it, or is it set to "GMT: Coordinated Universal Time"? During the summer, London is on British Summer Time, and the Windows UI is not clear that there is a difference between real GMT and London time.

Nevertheless there is probably a bug in Splunk in that Splunk indexing seems to think that your machine is on "real" GMT, when in fact it's on British Time which switches between GMT and BST, and so does not make the appropriate adjustment when it stores the timestamps internally. It's likely/possible that Splunk indexing suffers from that same confusion as Windows probably presents a confusing time zone name to the APIs as well. At the same time, when times are displayed to the user, they are probably correctly converted according to the current offset of the display timezone. Or maybe it's the other way around.

gkanapathy
Splunk Employee
Splunk Employee

Ah, then the problem is that Splunk probably just looks at the time zone name/description, and ignores the DST flag.

0 Karma

atulmistry
Engager

i had it set to GMT: Dublin, Edinburgh, Lisbon, London with the daylight saving flag turned off. i changed it to GMT: Monrovia, Reykjavik and that resolved my issue. Thanks,

0 Karma

LBG_Ankit
New Member

Hi Atul,

can you please let em know what props u have used to resolve this issue.
My issue is something like that, the logs are coming one hour delay(index time) from the venet generated time. And I need to change it to GMT+1 for BST as we are in BST currently?

Thanks,
Ankit

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

REGISTER NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more ...

Security Highlights | November 2022 Newsletter

 November 2022 2022 Gartner Magic Quadrant for SIEM: Splunk Named a Leader for the 9th Year in a RowSplunk is ...

Platform Highlights | November 2022 Newsletter

 November 2022 Skill Up on Splunk with our New Builder Tech Talk SeriesCan you build it? Yes you can! *play ...