Splunk Search

Splunk taking wrong time from logs

Path Finder

Splunk adds one hour to timestamp, when indexing logs.

9/18/17 3:46:01.000 PM --> time splunk shows
[][hello][please][help][18/Sep/2017:14:46:01 -0500] --> actual log

I have added the below in my props.conf
TZ = US/Eastern

Also tried TZ = America/New_York ( GMT -5:00)

Server shows this date - Sat Sep 30 15:22:18 EDT 2017

Tags (1)
0 Karma


Assuming that your user is set to Eastern time, then the display of _time in Splunk is correct for what your log has printed:

Your log explicitly states that it's "14:46 UTC-5" which is 15:46 (or 3:46p) in US/Eastern right now (Remember... EDT is UTC-4).

It could be your log is printing the wrong UTC offset, assuming that event you have there actually was at 14:46 EDT instead of 14:46 -0500 You may want to compare the delta of _time and _indextime to figure out if you have an issue there or not.

The explicit time zone in the log takes precedence when determining time zone: https://docs.splunk.com/Documentation/Splunk/7.0.0/Data/Applytimezoneoffsetstotimestamps

0 Karma
Get Updates on the Splunk Community!

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...