Getting Data In

Log time differs from time on splunk host

suhprano
Path Finder

I'm running splunk in windows where the time is in PST.

I read logs in GMT time, so when I search for most recent, it yields 0 results because all my data is indexed in GMT time (technically in the future).

Example:
IIS log

2011-08-02 23:42:01 W3SVC1...

But current time on system is 4:42 PM PST.

So when I issue a search for the current time, it searches and returns for data at 4:442PM PST, not 4:42PM GMT.

Is there a work around for this?

Tags (1)
0 Karma

MartinHarper
Path Finder

This page explains how to set up Splunk’s props.conf to convert data sources from a specified time format: Specify Timezones of Timestamps

Example: to set all IIS sources to be imported from UTC, add:

[sourcetype::iis]
TZ = Etc/UTC

This assumes that your IIS logs have a sourcetype of "iis" - adjust appropriately for your system.

Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...