splunk shows time 4 hours behind.

kamalbeg · ‎10-31-2018

I am getting some data from docker application. Client is telling me that in his log file the time stamp is up to date but when it comes to splunk, its 4 hours behind.

On indexer, I have created the props.conf file and have the following entry

more props.conf
[source::/var/tmp/log/*]
TZ = US/Eastern

How can I fix this?

bcyates · ‎11-01-2018

It sounds like the timestamp coming over is in UTC. Change your props to account for the difference.

[source::/var/tmp/log/*]
TZ = UTC

kamalbeg · ‎11-01-2018

Both the client server and splunk servers are in EST

cmerriman · ‎10-31-2018

what is the user time zone set as?

splunk shows time 4 hours behind.

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Introducing ITSI 5.0: Unified Visibility and Actionable Insights

Inside Splunk Agent Observability: Understanding Agent Behavior, Tokens & Costs

From Data to Insight: Announcing the Winners of the Splunk Dashboard Contest

Join the Conversation

splunk shows time 4 hours behind.

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Introducing ITSI 5.0: Unified Visibility and Actionable Insights

Inside Splunk Agent Observability: Understanding Agent Behavior, Tokens & Costs

From Data to Insight: Announcing the Winners of the Splunk Dashboard Contest