Splunk - Adjusting source file timestamp

[nageshkumarapp]

Given:
I have two log files (file_1, file_2)
Each from a different server (server_1, server_2).
The servers are not property synchronized via ntpd. (Example: server_1 is 13 seconds ahead of server_2.)
I do not have the ability to adjust or correct the server times.
I am the Splunk user, not the Splunk administrator.

Problem: After ingesting each of the log files, the events are off by 13 seconds (obviously).

Question: Can I adjust the _time for all events in source=file_2 by 13 seconds so the events line up correctly in search results, graphs, etc.?

[jkat54]

You can do it in search like this:

  ...| eval _time=if(host=server_2,_time+13,_time) | convert ctime(_time)

_time equals (if server_2, add 13s to_time, else use _time)

The eval will end up changing _time to epoch in visualizations... add the convert to swap it back to human readable format.

You can do it in search time props like this (maybe, just not sure if it works with _time)

 [host::server_2]
 EVAL-_time = _time+13

Cheers,
JKAT

[cpetterborg]

You will have to regularly check the time drift and update accordingly (or automate it) because unchecked system time will continue to drift further

You COULD also use the index_time instead of _time for your searching, though that could have a little bit of latency (but hopefully not 13 seconds worth). That won't require the updating of the time drift.

[jkat54]

I concur!!!