Why would the date_hour not match my event timestamps?

[djfisher]

I have many hosts with the correct event time, these all forward to two receivers with the correct time. I wanted to search by "date_hour" to show after hour events. I notice that the "date_hour" is reporting 5 hours in the future on all hosts and events. Where is this time stamp coming from? Can it be synchronized?

I am reporting on /var/log/audit/audit.log using souretype=linux_audit.

[asgupte]

I have a similar problem. The even logs have a certain GMT +11 correction and I need to match the two timestamps and I need no correction.

Which file do I need to modify so that the two timestamps corresponding to one event (from a search) match(and without any GMT corrections) ??

Bit of urgency, would appreciate a quick help !

[gkanapathy · Accepted solution]

date_hour is the hour in the text of the event, unadjusted for time zone. We keep this specifically because when searching by hour of day, it's more common to care about the local time of the event than the absolute time. You can offset it by using the date_zone field. If date_zone is local or null, the offset is the same as the Splunk server offset. But in your case, the offset is probably different, in which case you can offset by doing (date_hour-(date_zone/60))%24 to convert to the UTC hour, or (date_hour-((date_zone-local_tz_offset_minutes)/60))%24 to convert to the local TZ.