Getting Data In

What is causing Constant time diff of 12 hrs (_indextime - _time)?

pavanbmishra
Path Finder

Hi,

 

There is constant time diff (_indextime - _time) from few windows server as below, not sure what causing this and how to fix it

pavanbmishra_0-1651137952203.png

 

Labels (1)
Tags (1)
0 Karma

pavanbmishra
Path Finder

Thanks Giuseppe, seems to be AM/PM parsing issue. How this could be addressed?

0 Karma

gcusello
Esteemed Legend

Hi @pavanbmishra,

you should see your logs and the props.conf related to your sourcetype and eventually add to it the timezone definition.

Ciao.

Giuseppe

0 Karma

gcusello
Esteemed Legend

Hi @pavanbmishra,

a fixed difference like this can have one of the following three causes:

  • there's a timezone difference to consider;
  • a timestamp parsing error: the timestamp parsing doesn't consider AM/PM;
  • servers internal clock aren't aligned.

In my experience the fist option is the more possible.

In this case you have to analyze your logs and the parser and change the timezone setting.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Avoid Certificate Expiry Issues in Splunk Enterprise with Certificate Assist

This blog post is part 2 of 4 of a series on Splunk Assist. Click the links below to see the other ...

Using Machine Learning for Hunting Security Threats

REGISTER NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more ...