Getting Data In

Splunk - Adjusting source file timestamp

nageshkumarapp
New Member

Given:
I have two log files (file_1, file_2)
Each from a different server (server_1, server_2).
The servers are not property synchronized via ntpd. (Example: server_1 is 13 seconds ahead of server_2.)
I do not have the ability to adjust or correct the server times.
I am the Splunk user, not the Splunk administrator.

Problem: After ingesting each of the log files, the events are off by 13 seconds (obviously).

Question: Can I adjust the _time for all events in source=file_2 by 13 seconds so the events line up correctly in search results, graphs, etc.?

0 Karma

jkat54
SplunkTrust
SplunkTrust

You can do it in search like this:

  ...| eval _time=if(host=server_2,_time+13,_time) | convert ctime(_time)

_time equals (if server_2, add 13s to_time, else use _time)

The eval will end up changing _time to epoch in visualizations... add the convert to swap it back to human readable format.

You can do it in search time props like this (maybe, just not sure if it works with _time)

 [host::server_2]
 EVAL-_time = _time+13

Cheers,
JKAT

cpetterborg
SplunkTrust
SplunkTrust

You will have to regularly check the time drift and update accordingly (or automate it) because unchecked system time will continue to drift further

You COULD also use the index_time instead of _time for your searching, though that could have a little bit of latency (but hopefully not 13 seconds worth). That won't require the updating of the time drift.

jkat54
SplunkTrust
SplunkTrust

I concur!!!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...