Getting Data In

Timestamp mismatch occurring from events with the Splunk timestamp .

Path Finder

Hi Please help me fix this would like to consider the TIME stamp extracted from the events , but i see two different time format s in events as you can see in below events .
And , the search head settings has default time zone settings --- CST zone .
Here is the props.conf i have written . Please help me parse the correct time stamp.

[smr]
pulldowntype = true
NO
BINARYCHECK=true
disabled=false
SHOULD
LINEMERGE=true
MAXTIMESTAMPLOOKAHEAD=150
MAX_EVENTS=15000
TRUNCATE=100000

alt text

0 Karma
1 Solution

Path Finder

I can see that the time off set with the actual events and the splunk time zone has 1 and half hour difference . one hours 30 mins diff.

0 Karma