Splunk Search

Event time discrepancy

nbrazier21
Engager

When searching through certain sour ectypes and indexes, seeing a discrepancy between time and date for event time. Suggestions welcomed on diagnosing this issue.

Thanks in advance.Time.JPG

 

Labels (1)
0 Karma

somesoni2
Revered Legend

I would start by looking at timestamp parsing configuration for those sourcetypes. 

Reference: https://docs.splunk.com/Documentation/SplunkCloud/latest/Data/Configuretimestamprecognition

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...