Splunk - Server and Application logs timestamps ar...

vilashegde · ‎06-19-2018

We have a set of servers where the server Timezone is in PST/PDT but the application running on that server has log timestamps in UTC. We have setup some Alerts on those servers. Due to the timestamp mis-match, the alerts are triggered with the delay of 7 or 8 hours depending on whether Daylight saving is in effect (Since PST = UTC-8 and PDT=UTC-7). Splunk is considering the application log timestamp in PST/PDT and reporting accordingly.
Is there any way around this? Please suggest.

renjith_nair · ‎06-20-2018

Hi @vilashegde,

You can set the timezones for events in props conf as mentioned in Apply timezone offsets to timestamps
This could be done based on the source or sourcetype or host

---
What goes around comes around. If it helps, hit it with Karma 🙂

Splunk - Server and Application logs timestamps are different

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Think Like an Architect: Introducing the Splunk Certified Cybersecurity Defense ...

Index This | What has goals but no motivation?

Deep Dive: Accelerate threat investigation with Splunk’s AI Assistant in Security

Join the Conversation