Splunk Enterprise Security

splunk time stamp

trojan_81
Path Finder

Hello,

When I'm looking at an event, there is a TIME field to the left column and then the actual event has it's own time listed as well.
Is the TIME column using the clock from my PC and the Time within the event is the time reported by the log source?

0 Karma

to4kawa
Ultra Champion
| makeresults 
| eval _time=strftime(_time,"%F %T %z")

In UTC, this result is +0000 or -0000.
Which one is actually?

0 Karma

woodcock
Esteemed Legend

The Time field is being adjusted to match your Time zone setting in your user's Preferences. Keep in mind that the timestamp of the event is not always based on the string that is in _raw. Some people are lazy and use inadvisable settings like DATETIME_CONFIG = current.

0 Karma

trojan_81
Path Finder

Thank you somesoni2. Looks like I am on UTC time.
What does "strftime" stand for?

0 Karma

woodcock
Esteemed Legend

STRing Format TIME.

0 Karma

trojan_81
Path Finder

Woodcock,

When I drill into my username and then perferences I see the timezone is set to "Default System Timezone". Where can I find out what the default system timezone is?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

You'd need to log onto the server to see that. OR if your Timezone is set to "Default System Timezone", then you can find your timezone (which is same as system timezone in this case), by running a search like this

| makeresults | eval timezone=strftime(_time,"%Z (%z)")
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The time within the event is the raw data from the source. The value in the TIME column (which I assume is _time renamed) is Splunk's interpretation of when the event happened. It should be the same as one of the time strings in the event. It will be displayed in the time zone you selected in your Splunk preferences.

---
If this reply helps you, Karma would be appreciated.
0 Karma

trojan_81
Path Finder

I meant to say the other way around. Is the TIME column reported in UTC time and the time within the event what the log source sent?

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...