Solved: Event time inconsistency

shangshin · ‎08-20-2012

Hi,
I have a stanza below defined in transforms.conf.

[wip_fields]
DELIMS = ","
FIELDS = timestamp,wip,vip

Strangely, the event time is not consistent with the timestamp in each record. It seems the event time is always 5 hours ahead of the timestamp. I suspect I need to set the timezone explicitly? Please share some thoughts or suggestion. Thanks!

table _time,timestamp

8/20/12 4:30:17.000 AM  08/20/2012 09:30:17

dwaddle · ‎08-20-2012

If the system parsing the events (normally the indexer, but could be a heavy forwarder) is in a different timezone than the data being indexed, then you will need to provide a TZ offset. Use a props.conf config entry of the form:

[sourcetype]
TZ=America/Chicago

This is an index-time setting so you will have to reload previously indexed data.

View solution in original post

dwaddle · ‎08-20-2012

If the system parsing the events (normally the indexer, but could be a heavy forwarder) is in a different timezone than the data being indexed, then you will need to provide a TZ offset. Use a props.conf config entry of the form:

[sourcetype]
TZ=America/Chicago

This is an index-time setting so you will have to reload previously indexed data.

Event time inconsistency

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Analytics Workspace deprecation

Splunk Developer Day Recap: Building, Publishing, and Growing on the Splunk Platform

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

Join the Conversation