Why is Event Log time and Indexed time different?

[Atchyuth_P]

hi,

Please check with below screenshot

The indexed time and event log time both are different. Kindly let me know the solution to fix this error.

[wapese3400]

[gcusello]

Hi @Atchyuth_P,

this means thet there's a parsing error.

Could your share a sample of your logs to find the correct configuration?

Ciao.

Giuseppe

[Atchyuth_P]

Hi @gcusello 

Please check the below screenshot for reference.

I have applied the MAX_DAYS_AGO setting in Splunk it identified the Y-m-d but was unable to find out the exact hours, minutes, seconds 

I have tried with the TZ setting but was unable to solve it.

Please help

[gcusello · Accepted solution]

Hi @Atchyuth_P,

anyway, please try in your props.conf:

[your_sourcetype]
TIME_PREFIX = ^\d+\.\d+\.\d+\.\d+\s+w\s+\w+\s+\[
TIME_FORMAT = %Y-%m-%d \s+\H:|M:|S.%6N
MAX_TIMESTAMP_LOOKAHEAD = 26

This props.conf must be located on Indexers or (if present) On Heavy Forwarders.

Ciao.

Giuseppe

[gcusello]

Hi @Atchyuth_P,

please share your logs as text in the "Insert/Edit Code Sample" otherwise I cannot use them.

Ciao.

Giuseppe

[chaker]

Hello,

You will need to provide timestamp extraction settings to correctly identify that time stamp, if none of the pre trained source types are picking it up.

I suggest you try to add that data using different sourcetypes in the data preview tool, to see which on extracts your time stamp, then use that setting in your own sourcetype settings.

https://docs.splunk.com/Documentation/Splunk/9.0.0/Data/HowSplunkextractstimestamps

https://docs.splunk.com/Documentation/Splunk/9.0.0/Admin/Propsconf#Timestamp_extraction_configuratio...

[Atchyuth_P]

Hi @chaker 

Thank you so much. I have learned a lot about Splunk while watching your videos and those helped me to shift my career transition.

Please check the below screenshot for reference.

I have applied the MAX_DAYS_AGO setting in Splunk it identified the Y-m-d but was unable to find out the exact hours, minutes, seconds

I have tried with the TZ setting but was unable to solve it.

Please help

[chaker]

This may help you.

https://www.youtube.com/watch?v=Q5EWCT79nZ4