Getting Data In

Timestamp mismatch occurring from events with the Splunk timestamp .

guru865
Path Finder

Hi Please help me fix this would like to consider the TIME stamp extracted from the events , but i see two different time format s in events as you can see in below events .
And , the search head settings has default time zone settings --- CST zone .
Here is the props.conf i have written . Please help me parse the correct time stamp.

[smr]
pulldown_type = true
NO_BINARY_CHECK=true
disabled=false
SHOULD_LINEMERGE=true
MAX_TIMESTAMP_LOOKAHEAD=150
MAX_EVENTS=15000
TRUNCATE=100000

alt text

0 Karma
1 Solution

guru865
Path Finder

I can see that the time off set with the actual events and the splunk time zone has 1 and half hour difference . one hours 30 mins diff.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...