Getting Data In
Provide Splunk Cloud feedback in this confidential UX survey by June 17
for a chance to win a $200 Amazon gift card!

Time Stamp - Log Delay

omuelle1
Communicator

Hi Splunk users,

I have a problem regarding Splunk showing incorrect timestamps:

Splunk pretty much shows me timestamps with a 5 hour delay. If an something is logged in the logs I monitor, it is logged in EST (it says GMT -5:00 though and I think that is the problem). However the log looks like this:

alt text

It reads GMT -5:00 in the log file and Splunk goes ahead and reads that and shows me the logs only 5 hours after the event occurs. The log file however is written in EST and not GMT.

I changed my props.conf to tell Splunk that we are in EST. What could I change in order for Splunk to just read the timestamp out of the log without GMT -5:00, because I think this where the problem comes from.

Also see my props.conf:

TRUNCATE = 10000
TIME_PREFIX = ^
TIME_FORMAT = %Y-%m-%d %H:%M:%S
MAX_TIMESTAMP_LOOKAHEAD = 29
TZ = America/New_York

I did not set these settings myself, except the TZ setting. So I don't know where the MAX_TIMESTAMP_LOOKAHEAD = 10, is coming from or the TIME_FORMAT.

Thank you very much for your help,

Oliver

0 Karma
1 Solution

omuelle1
Communicator

I actually was able to fix it.

Once I put the props.conf settings also on the indexers, it started indexing correctly.

I am not sure why, but I now have the correct time.

View solution in original post

0 Karma

omuelle1
Communicator

I actually was able to fix it.

Once I put the props.conf settings also on the indexers, it started indexing correctly.

I am not sure why, but I now have the correct time.

View solution in original post

0 Karma

DMohn
Motivator

I reckon the TIME_FORMAT string is wrong here ...

It should read TIME_FORMAT = %Y %b %d %H:%M:%S:%3N %Z

Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!