Getting Data In

What timezone does collect use?

khevans
Path Finder

There is something wrong (or not obvious from the documentation) with how collect takes timezones.

_time fields should be stored in unixtime, right?

I have a report which does a long search and I use collect to take a _time and I use addtime=t to use that _time in the new field.

The original timestamp is stored as:

2019-07-29 23:16:51.884 INFO ... in _raw (UTC). And its timestamp field is set to 2019-07-29 23:16:51.884 (UTC) and in my browser, the _time is set as 2019-07-29T16:16:51.884-07:00. That's all correct.

When I use collect and use that _time, it gets stored as 2019-07-29 23:16:51.884 in the _raw, 2019-07-29 23:16:51.884 in the timestamp field, but it incorrectly uses 2019-07-29T23:16:51.884-07:00 for _time. I don't know why it's using that timezone when it's passing the _time (which I thought was unixtime, which is always UTC).

How can I correct for this bug in Splunk?

Labels (1)
0 Karma

joesrepsolc
Communicator

Seeing this exact same thing. Somehow my timestamp (_time) has -07:00 on the end of it, and this is not the timezone setting of my laptop, or the dataset (in a different timezone). Very strange indeed. Cannot find any other comments about this other than your post.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...