Getting Data In

Why would the date_hour not match my event timestamps?

djfisher
Explorer

I have many hosts with the correct event time, these all forward to two receivers with the correct time. I wanted to search by "date_hour" to show after hour events. I notice that the "date_hour" is reporting 5 hours in the future on all hosts and events. Where is this time stamp coming from? Can it be synchronized?

I am reporting on /var/log/audit/audit.log using souretype=linux_audit.

Tags (2)
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

date_hour is the hour in the text of the event, unadjusted for time zone. We keep this specifically because when searching by hour of day, it's more common to care about the local time of the event than the absolute time. You can offset it by using the date_zone field. If date_zone is local or null, the offset is the same as the Splunk server offset. But in your case, the offset is probably different, in which case you can offset by doing (date_hour-(date_zone/60))%24 to convert to the UTC hour, or (date_hour-((date_zone-local_tz_offset_minutes)/60))%24 to convert to the local TZ.

View solution in original post

asgupte
New Member

I have a similar problem. The even logs have a certain GMT +11 correction and I need to match the two timestamps and I need no correction.

Which file do I need to modify so that the two timestamps corresponding to one event (from a search) match(and without any GMT corrections) ??

Bit of urgency, would appreciate a quick help !

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

date_hour is the hour in the text of the event, unadjusted for time zone. We keep this specifically because when searching by hour of day, it's more common to care about the local time of the event than the absolute time. You can offset it by using the date_zone field. If date_zone is local or null, the offset is the same as the Splunk server offset. But in your case, the offset is probably different, in which case you can offset by doing (date_hour-(date_zone/60))%24 to convert to the UTC hour, or (date_hour-((date_zone-local_tz_offset_minutes)/60))%24 to convert to the local TZ.

Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...