Splunk Search

Splunk showing 2 different times

jensterddcaa
New Member

Hello! in the process of checking time on our Splunk server, I came up with some puzzling results.

If I do a search query on my search head, I get this result: 2019-10-01T08:16:00-0400
Query is: * | stats count | eval clock = strftime(time(), "%Y-%m-%dT%H:%M:%S%z") | table clock

If I query through the Splunk API, I get this results: 1969-12-31T19:00:00-05:00
rest /services/server/info | eval updated_t=round(strptime(updated, "%Y-%m-%dT%H:%M:%S%z"), 2)

That's a 50 year difference! Any help greatly appreciated.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

In most Splunk REST queries, the updated field is zero. I've rarely seen it populated and wouldn't rely on it for anything.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...

The Visibility Gap: Hybrid Networks and IT Services

The most forward thinking enterprises among us see their network as much more than infrastructure – it's their ...

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...