Getting Data In

Splunk - Server and Application logs timestamps are different

vilashegde
New Member

We have a set of servers where the server Timezone is in PST/PDT but the application running on that server has log timestamps in UTC. We have setup some Alerts on those servers. Due to the timestamp mis-match, the alerts are triggered with the delay of 7 or 8 hours depending on whether Daylight saving is in effect (Since PST = UTC-8 and PDT=UTC-7). Splunk is considering the application log timestamp in PST/PDT and reporting accordingly.
Is there any way around this? Please suggest.

Tags (1)
0 Karma

renjith_nair
Legend

Hi @vilashegde,

You can set the timezones for events in props conf as mentioned in Apply timezone offsets to timestamps
This could be done based on the source or sourcetype or host

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...