Re: Splunk - Server and Application logs timestamp...

vilashegde · ‎06-19-2018

We have a set of servers where the server Timezone is in PST/PDT but the application running on that server has log timestamps in UTC. We have setup some Alerts on those servers. Due to the timestamp mis-match, the alerts are triggered with the delay of 7 or 8 hours depending on whether Daylight saving is in effect (Since PST = UTC-8 and PDT=UTC-7). Splunk is considering the application log timestamp in PST/PDT and reporting accordingly.
Is there any way around this? Please suggest.

renjith_nair · ‎06-20-2018

Hi @vilashegde,

You can set the timezones for events in props conf as mentioned in Apply timezone offsets to timestamps
This could be done based on the source or sourcetype or host

---
What goes around comes around. If it helps, hit it with Karma 🙂

Splunk - Server and Application logs timestamps are different

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Fuel Your Journey: What’s Waiting for You at the .conf26 Acceleration Station

Join the Final Session of the Data Management & Federation Bootcamp Series

From Data to Insight: Announcing the Winners of the Splunk Dashboard Contest

Join the Conversation