Time Stamp - Log Delay

[omuelle1]

Hi Splunk users,

I have a problem regarding Splunk showing incorrect timestamps:

Splunk pretty much shows me timestamps with a 5 hour delay. If an something is logged in the logs I monitor, it is logged in EST (it says GMT -5:00 though and I think that is the problem). However the log looks like this:

It reads GMT -5:00 in the log file and Splunk goes ahead and reads that and shows me the logs only 5 hours after the event occurs. The log file however is written in EST and not GMT.

I changed my props.conf to tell Splunk that we are in EST. What could I change in order for Splunk to just read the timestamp out of the log without GMT -5:00, because I think this where the problem comes from.

Also see my props.conf:

TRUNCATE = 10000
TIME_PREFIX = ^
TIME_FORMAT = %Y-%m-%d %H:%M:%S
MAX_TIMESTAMP_LOOKAHEAD = 29
TZ = America/New_York

I did not set these settings myself, except the TZ setting. So I don't know where the MAX_TIMESTAMP_LOOKAHEAD = 10, is coming from or the TIME_FORMAT.

Thank you very much for your help,

Oliver

[omuelle1 · Accepted solution]

I actually was able to fix it.

Once I put the props.conf settings also on the indexers, it started indexing correctly.

I am not sure why, but I now have the correct time.

[DMohn]

I reckon the TIME_FORMAT string is wrong here ...

It should read TIME_FORMAT = %Y %b %d %H:%M:%S:%3N %Z