Getting Data In

Splunk Linux TA - packages script, some hosts have time in the future

splunk219783
Path Finder

I'm running what I believe to be a somewhat standard input, from the Splunk Linux TA.  I just realized for some hosts the time is in the future.  All other time for logs from these hosts is correct,  only the package.sh output is 15 minutes in the future.

Time on the affected hosts is correct.  How can it have the wrong time when it was a script Splunk executed itself?

Input:

 

[script:///opt/splunkforwarder/etc/apps/Splunk_TA_nix/bin/package.sh]
sourcetype = package
source = package
interval =  86400
disabled = false
index = os

 

 

Labels (2)
0 Karma

codebuilder
Influencer

Have you checked to be sure the time zone set for your user matches the time zone on the server?

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma

splunk219783
Path Finder

My timezone is set to default system timezone.

Looking at it now, it seems to primarily be one sourcetype mailog-too-small, but only on some hosts.

The event has the correct time, but the actual event time is 4 hours ahead.

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...