Getting Data In

Splunk Linux TA - packages script, some hosts have time in the future

splunk219783
Path Finder

I'm running what I believe to be a somewhat standard input, from the Splunk Linux TA.  I just realized for some hosts the time is in the future.  All other time for logs from these hosts is correct,  only the package.sh output is 15 minutes in the future.

Time on the affected hosts is correct.  How can it have the wrong time when it was a script Splunk executed itself?

Input:

 

[script:///opt/splunkforwarder/etc/apps/Splunk_TA_nix/bin/package.sh]
sourcetype = package
source = package
interval =  86400
disabled = false
index = os

 

 

Labels (2)
0 Karma

codebuilder
Influencer

Have you checked to be sure the time zone set for your user matches the time zone on the server?

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma

splunk219783
Path Finder

My timezone is set to default system timezone.

Looking at it now, it seems to primarily be one sourcetype mailog-too-small, but only on some hosts.

The event has the correct time, but the actual event time is 4 hours ahead.

0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...