Getting Data In

What is causing Constant time diff of 12 hrs (_indextime - _time)?

pavanbmishra
Path Finder

Hi,

 

There is constant time diff (_indextime - _time) from few windows server as below, not sure what causing this and how to fix it

pavanbmishra_0-1651137952203.png

 

Labels (1)
Tags (1)
0 Karma

pavanbmishra
Path Finder

Thanks Giuseppe, seems to be AM/PM parsing issue. How this could be addressed?

0 Karma

gcusello
Esteemed Legend

Hi @pavanbmishra,

you should see your logs and the props.conf related to your sourcetype and eventually add to it the timezone definition.

Ciao.

Giuseppe

0 Karma

gcusello
Esteemed Legend

Hi @pavanbmishra,

a fixed difference like this can have one of the following three causes:

  • there's a timezone difference to consider;
  • a timestamp parsing error: the timestamp parsing doesn't consider AM/PM;
  • servers internal clock aren't aligned.

In my experience the fist option is the more possible.

In this case you have to analyze your logs and the parser and change the timezone setting.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...