Getting Data In

timezone issue with custom log time date stamp

ebailey
Communicator

I have a log with a custom time date stamp. I am running into an issue where the index time is exactly one hour ahead of the event time stamp in the log. Could this be an issue with how I defined the date stamp in my props? I should add that the application server and the splunk server are set to use CST and have the correct system time.

Here is a time stamp from the log

2014-06-04T11:38:15.190 CST

My props for the time stamp

[prd_ufo_stats]
TIME_PREFIX = ^
MAX_TIMESTAMP_LOOKAHEAD = 20
TIME_FORMAT = %Y-%m-%dT%H:%M:%S:%3N %Z
LINE_BREAKER = ([\r\n]+)
SHOULD_LINEMERGE = False
TRUNCATE = 100000
KV_MODE = None

Thanks!

Tags (2)
0 Karma

jarjoh42
Path Finder
0 Karma

ebailey
Communicator

Missing something- the props for this sourcetype is on the search head so I made the change and added "TZ = US/Central" and then restarted the search head with no difference.

Do I need to drop %Z from the timestamp defined in props? Everything involved with the data stream is in CST so I am not sure why this is the issue other than the custom time date stamp.

0 Karma

k_harini
Communicator

Did this work? I'm facing same issue

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...