Getting Data In

Why are similar events showing different datetimes?


I'm facing something strange about _time and timezone.

We have 2 hosts indexing the same event type (Unix:Uptime).

On the search head, I have the following situation:

1 - The first host shows the correct timestamp
2 - The second host shows the timestamp 1 hour ago

The events have the same timezone and the same "date_hour" field.

What I'm doing wrong?

alt text

0 Karma

Esteemed Legend

Ignore all the date_* fields unless you desire to ignore your personal Time zone setting and like the time normalized to UTC/GMT (which is what those fields are). Check your Time zone setting and also the _indextime value. I suspect that you are seeing the result of falling back for Daylight Savings.

0 Karma


Daylight savings kicked in over the weekend. Have you validated that the OS properly updated the time on the box where the forwarder is off?



Yes, I have already checked the time in the universal forwarders, heavy forwarders, indexers and search heads.

Here in Brazil the daylight savings should have started the last weekend, but we don´t have it anymore.

Note that the raw events is being indexed with the correct timestamp, but in some cases the search head shows the wrong date.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!