Splunk Enterprise Security

splunk time stamp

trojan_81
Path Finder

Hello,

When I'm looking at an event, there is a TIME field to the left column and then the actual event has it's own time listed as well.
Is the TIME column using the clock from my PC and the Time within the event is the time reported by the log source?

0 Karma

to4kawa
SplunkTrust
SplunkTrust
| makeresults 
| eval _time=strftime(_time,"%F %T %z")

In UTC, this result is +0000 or -0000.
Which one is actually?

0 Karma

woodcock
Esteemed Legend

The Time field is being adjusted to match your Time zone setting in your user's Preferences. Keep in mind that the timestamp of the event is not always based on the string that is in _raw. Some people are lazy and use inadvisable settings like DATETIME_CONFIG = current.

0 Karma

trojan_81
Path Finder

Thank you somesoni2. Looks like I am on UTC time.
What does "strftime" stand for?

0 Karma

woodcock
Esteemed Legend

STRing Format TIME.

0 Karma

trojan_81
Path Finder

Woodcock,

When I drill into my username and then perferences I see the timezone is set to "Default System Timezone". Where can I find out what the default system timezone is?

0 Karma

somesoni2
Revered Legend

You'd need to log onto the server to see that. OR if your Timezone is set to "Default System Timezone", then you can find your timezone (which is same as system timezone in this case), by running a search like this

| makeresults | eval timezone=strftime(_time,"%Z (%z)")
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The time within the event is the raw data from the source. The value in the TIME column (which I assume is _time renamed) is Splunk's interpretation of when the event happened. It should be the same as one of the time strings in the event. It will be displayed in the time zone you selected in your Splunk preferences.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

trojan_81
Path Finder

I meant to say the other way around. Is the TIME column reported in UTC time and the time within the event what the log source sent?

0 Karma