Getting Data In

Wrong Timestamp

astepanov
Explorer

Hi all,

Splunk adds one hour to timestamp, when indexing logs.

Example of my logs:

[ 21/Feb/2012 1:05:32.306 PM] I got ID_TRANS ...

so when such log falls into splunk, it got a timestamp like
2/21/12
2:05:32.306 PM

My props.conf for these logs is:

[sourcetype::verytest]
MAX_TIMESTAMP_LOOKAHEAD=31
NO_BINARY_CHECK=1
TIME_FORMAT=%d/%b/%y %H:%M:%S.%3N %p

My timezone is -
(GMT +03:00) Moscow, St. Petersburg, Volgograd

What I`m doing wrong?

0 Karma
1 Solution

MarioM
Motivator

You could try to assign the timezone in your props.conf: Apply Timezone

View solution in original post

astepanov
Explorer

Thx, MarioM

it Really Helps.

For Russia Moscow props.conf for such logs should looks like this one:

[sourcetype::your_sourcetype_name]
MAX_TIMESTAMP_LOOKAHEAD = custom, for example 31
NO_BINARY_CHECK=1 (Do not check for binary, Speed up Perfomance)
TIME_FORMAT=%d/%b/%y %H:%M:%S.%3N %p (Custom date timeformat, to help indexer understand timespamps, [more info][1])
TZ=Europe/Moscow

TZ should be equals to TZ=Europe/Moscow (Only for logs in Mosow TimeZone (+03.00)).

0 Karma

greg
Communicator

Yes, I have checked everything twice.
My situation is stated in this question:
http://splunk-base.splunk.com/answers/40985/time-zone-recognition-still-doesnt-work-after-editing-pr...

Could you please check on your system, do you really have UTC+0300 for Europe/Moscow?

0 Karma

astepanov
Explorer

Ohg, It`s my fault, sorry.

Did you check time on your server with Splunk installation, is it correct?

0 Karma

greg
Communicator

Well, according to this wikipedia table, column "Standard Time", Asia/Krasnoyarsk is UTC+08:00, which is too much for me 😉 I'm still in Europe/Moscow (not Moscow +0400).

0 Karma

astepanov
Explorer

Hi, greg!

For UTC +04.00 you should use Asia/Krasnoyarsk it will gives you UTC +04.00 for more information about timezone, you could study MarioM link (http://en.wikipedia.org/wiki/List_of_zoneinfo_timezones)

0 Karma

greg
Communicator

Hi!
Do you have UTC+03:00 after assigning TZ=Europe/Moscow?

I'm struggling with the same issue at the moment, i.e. Europe/Moscow gives me UTC+03:00, but we are actually in UTC+04:00.

0 Karma

MarioM
Motivator

You could try to assign the timezone in your props.conf: Apply Timezone

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...