Splunk Enterprise Security

Why is ES changing Investigation Timeline Timestamp When Printing?

edwardrose
Contributor

Hello All,

We have just completed an upgrade to Splunk Base 7.1.2 and ES 5.1. We have a couple of ongoing investigations in ES and when we look at the details of these investigations in list mode.

ES Investigations-timestamps

We see the correct time and date that the event was logged into ES Investigations. But when we print the document, the time and date change to January 18, 1970

Printed_bad_timestamp

What could cause this issue?

Thanks
ed

0 Karma

smoir_splunk
Splunk Employee
Splunk Employee

It's a known bug that is fixed in version 5.0.0 of Splunk Enterprise Security. Maybe it was regressed? I'd suggest you follow up with your support contact.

Get Updates on the Splunk Community!

Buttercup Games: Further Dashboarding Techniques

Hello! We are excited to kick off a new series of blogs from SplunkTrust member ITWhisperer, who demonstrates ...

Message Parsing in SOCK

Introduction This blog post is part of an ongoing series on SOCK enablement. In this blog post, I will write ...

Exploring the OpenTelemetry Collector’s Kubernetes annotation-based discovery

We’ve already explored a few topics around observability in a Kubernetes environment -- Common Failures in a ...