Indexing Time Differs From Raw Log Time

[anandhalagarasa]

Hi All,

We have configured log monitoring for set of servers. And when we searched the data for last 15 minutes, the raw data has a time in GMT and indexed time (Time) column is USA.

So kindly help to provide a solution to fix it asap.

[DalJeanis]

Okay, first thing, you will save yourself a WHOLE lot of pain if you have your indexer (really all your hosts) running UTC. I realize you don't have personal control over that, but it is something to mention to the senior techs pretty much every time this kind of thing comes up. Eventually when they propose this great bright idea to move everything over to UTC, you just keep your mouth shut and nod, so it gets done and a bunch of your headaches go away.

Second thing, have you verified that your indexers are not backlogged? (Assuming you were really talking about indextime, which has nothing to do with the event _time.) It is not great for them to be taking 15 minutes to catch up to ingest a particular event, but it's not an error.

Third, verify that your time configuration in props.conf for the appropriate sourcetype matches the event. Looks to me like your look-ahead needs to be at least 38-40 characters, and the time format should be this -

%Y-%m-%dT%H:%M:%S.%6N%:z

[anandhalagarasa]

Can anyone help on my query

[niketn]

What is the field/SPL you are using to compare time? is it _time or _indextime?

[anandhalagarasa]

its _time.