Getting Data In

Why would the date_hour not match my event timestamps?

djfisher
Explorer

I have many hosts with the correct event time, these all forward to two receivers with the correct time. I wanted to search by "date_hour" to show after hour events. I notice that the "date_hour" is reporting 5 hours in the future on all hosts and events. Where is this time stamp coming from? Can it be synchronized?

I am reporting on /var/log/audit/audit.log using souretype=linux_audit.

Tags (2)
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

date_hour is the hour in the text of the event, unadjusted for time zone. We keep this specifically because when searching by hour of day, it's more common to care about the local time of the event than the absolute time. You can offset it by using the date_zone field. If date_zone is local or null, the offset is the same as the Splunk server offset. But in your case, the offset is probably different, in which case you can offset by doing (date_hour-(date_zone/60))%24 to convert to the UTC hour, or (date_hour-((date_zone-local_tz_offset_minutes)/60))%24 to convert to the local TZ.

View solution in original post

asgupte
New Member

I have a similar problem. The even logs have a certain GMT +11 correction and I need to match the two timestamps and I need no correction.

Which file do I need to modify so that the two timestamps corresponding to one event (from a search) match(and without any GMT corrections) ??

Bit of urgency, would appreciate a quick help !

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

date_hour is the hour in the text of the event, unadjusted for time zone. We keep this specifically because when searching by hour of day, it's more common to care about the local time of the event than the absolute time. You can offset it by using the date_zone field. If date_zone is local or null, the offset is the same as the Splunk server offset. But in your case, the offset is probably different, in which case you can offset by doing (date_hour-(date_zone/60))%24 to convert to the UTC hour, or (date_hour-((date_zone-local_tz_offset_minutes)/60))%24 to convert to the local TZ.

Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...