Time Zone issue

[siva_cg]

Hi All,

We have application logs configured to Splunk. When I search for the last 15min there were no results but when I search for the last one hour it gave so many events. Upon checking it, I came to know that there is an time zone issue and have configured time zone configurations for these logs in props.conf. Even after that the issue persists. Could you please help me in checking what might be other issues in this case and what will be the configurations to be deployed in this case?

Thank you in advance.

[DalJeanis]

Have you verified how long it is taking the events to get indexed? Time zone issues usually work in terms of whole hours. (Yes, there are exceptions, but it's not the way to bet.)

Also, when checking recent events and suspecting time zone issues, try setting latest=+3d just in case your indexers are future-dating anything.

[siva_cg]

Hi @DalJeanis, I have calculated the difference between _indextime and _time, it is giving a negative number more than 3600. But not sure how to calculate the time taken for the events to get indexed. Could you please help me with the query to calculate it? Thank you in advance.

[mattymo]

Hi siva_cg,

Can you provide a couple sample (and anonymized) events and your configs so we can assist?

Otherwise I recommend using the add data wizard to ensure your configurations are sound.

https://docs.splunk.com/Documentation/Splunk/6.6.2/Data/Howdoyouwanttoadddata

[richgalloway]

When you says the issue persists after changing props.conf are you referring to new events or existing events?
Changing props.conf will have no effect on data already indexed.

[siva_cg]

Hi @richgalloway, I am referring to new events only. There is no effect on new events also.

[richgalloway]

Like mmodestino suggests, Posting your props.conf settings will help us determine if you have something set wrong.

[siva_cg]

Hi @richgalloway, @mmodestino, my props.conf for these logs are so simply and it looks as below:
[source::.../logpath/]
TZ = UTC

[niketn]

@siva_cg, the events timestamp _time displayed in Splunk will be based on logged in User's Timezone Settings. Can you try to set the same using the following documentation and check?

http://docs.splunk.com/Documentation/Splunk/latest/Security/ConfigureuserswithSplunkWeb