Getting Data In

Timestamp not being parsed correctly - Perfmon

rturk
Builder

Hi All,

I am collecting Perfmon data via the Splunk_TA_windows app and for some reason the time stamp is not being parsed correctly, specifically there is a delta between the Splunk assigned timestamp and the on in the event itself. e.g.:

alt text

Having looked through the internal logs I am not seeing anywhere that would indicate the queues are blocked, but I am still getting this discrepency. No modifications have been made to the TA , and it is has been installed on both the server that is sending the data, and the Indexer.

Any & all suggestions appreciated!

0 Karma

royimad
Builder

Add time zone to your time and this should be fixed

0 Karma

rturk
Builder

Unfortunately this won't help, as timezones differ (at a maximum) of 30 second increments. The delta above is ~2 minutes.

0 Karma

lukejadamec
Super Champion

There is something wrong with your time. As of the time of your posting it was not 11/12/13 23:00 hours anywhere on the planet. Are you in space?
Are you seeing the same thing with other servers' forwarders?

Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...