What is causing Constant time diff of 12 hrs (_indextime - _time)?

[pavanbmishra]

Hi,

There is constant time diff (_indextime - _time) from few windows server as below, not sure what causing this and how to fix it

[pavanbmishra]

Thanks Giuseppe, seems to be AM/PM parsing issue. How this could be addressed?

[gcusello]

Hi @pavanbmishra,

you should see your logs and the props.conf related to your sourcetype and eventually add to it the timezone definition.

Ciao.

Giuseppe

[gcusello]

Hi @pavanbmishra,

a fixed difference like this can have one of the following three causes:

• there's a timezone difference to consider;
• a timestamp parsing error: the timestamp parsing doesn't consider AM/PM;
• servers internal clock aren't aligned.

In my experience the fist option is the more possible.

In this case you have to analyze your logs and the parser and change the timezone setting.

Ciao.

Giuseppe