Splunk Search

Difference Between Event Time and _time

kirchoffbk
Observer

Hi all,

I have a problem about _time field. There is difference between event in time and _time field. Like below,

Wrong Time: 12/28/20 6:34:28 AM

Correct Time: 12/27/2020 07:34:28 PM

Screen Shot 2020-12-27 at 19.34.45.png

 

Do you have any idea about it?

 

 

 

Labels (1)
Tags (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

There are a few possible explanations.

  1. Your selected time zone does not match the time zone of the system that produced the event.
  2. The time field in the event does not have a time zone indication so Splunk assumed the time is in the Splunk server's time zone.
  3. The time field in the event does have a time zone indicator, but the TIME_FORMAT attribute in props.conf does not account for it.
  4. The TZ attribute in props.conf is not set correctly.
  5. The clock on the originating system is incorrect.
---
If this reply helps you, Karma would be appreciated.
0 Karma

kirchoffbk
Observer

It fixed after setting ntp&reboot on Windows 

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...