Splunk Search

Difference Between Event Time and _time

kirchoffbk
Observer

Hi all,

I have a problem about _time field. There is difference between event in time and _time field. Like below,

Wrong Time: 12/28/20 6:34:28 AM

Correct Time: 12/27/2020 07:34:28 PM

Screen Shot 2020-12-27 at 19.34.45.png

 

Do you have any idea about it?

 

 

 

Labels (1)
Tags (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

There are a few possible explanations.

  1. Your selected time zone does not match the time zone of the system that produced the event.
  2. The time field in the event does not have a time zone indication so Splunk assumed the time is in the Splunk server's time zone.
  3. The time field in the event does have a time zone indicator, but the TIME_FORMAT attribute in props.conf does not account for it.
  4. The TZ attribute in props.conf is not set correctly.
  5. The clock on the originating system is incorrect.
---
If this reply helps you, an upvote would be appreciated.
0 Karma

kirchoffbk
Observer

It fixed after setting ntp&reboot on Windows 

0 Karma