Getting Data In

What is causing Constant time diff of 12 hrs (_indextime - _time)?

pavanbmishra
Path Finder

Hi,

 

There is constant time diff (_indextime - _time) from few windows server as below, not sure what causing this and how to fix it

pavanbmishra_0-1651137952203.png

 

Labels (1)
Tags (1)
0 Karma

pavanbmishra
Path Finder

Thanks Giuseppe, seems to be AM/PM parsing issue. How this could be addressed?

0 Karma

gcusello
Esteemed Legend

Hi @pavanbmishra,

you should see your logs and the props.conf related to your sourcetype and eventually add to it the timezone definition.

Ciao.

Giuseppe

0 Karma

gcusello
Esteemed Legend

Hi @pavanbmishra,

a fixed difference like this can have one of the following three causes:

  • there's a timezone difference to consider;
  • a timestamp parsing error: the timestamp parsing doesn't consider AM/PM;
  • servers internal clock aren't aligned.

In my experience the fist option is the more possible.

In this case you have to analyze your logs and the parser and change the timezone setting.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...