Difference Between Event Time and _time

[kirchoffbk]

Hi all,

I have a problem about _time field. There is difference between event in time and _time field. Like below,

Wrong Time: 12/28/20 6:34:28 AM

Correct Time: 12/27/2020 07:34:28 PM

Do you have any idea about it?

[richgalloway]

There are a few possible explanations.

1. Your selected time zone does not match the time zone of the system that produced the event.
2. The time field in the event does not have a time zone indication so Splunk assumed the time is in the Splunk server's time zone.
3. The time field in the event does have a time zone indicator, but the TIME_FORMAT attribute in props.conf does not account for it.
4. The TZ attribute in props.conf is not set correctly.
5. The clock on the originating system is incorrect.

[kirchoffbk]

It fixed after setting ntp&reboot on Windows