Splunk Search

Time conversion from UST to EST in search results

vn86893
Explorer

Hello Team,

I am facing this issue where my logs are written in EST and the time stamp on the log is UST ( Lets say the log is written at 6PM EST and the time stamp in the log is 11PM). I am searching the logs in EST time zone. 2019-04-06 22:59:45.3711 is the timestamp format on the LOG

So the log written at 6PM EST having time stamp at 11pm isn't showing up in search until 11pm EST. I am not sure how to fix this thing. Any help is greatly appreciated.

I changed the time zone in my account to Eastern.

Tags (1)
0 Karma

dmarling
Builder

This won't fix the root cause of the problem that @somesoni2 mentioned, which is that you the sourcetype is not setup with an offset as explained in the documentation, but it can make the _time appear accurately as a search time work around. This can be used to show results from the last hour

Search with UCT earliest=now latest=+4h
| eval _time=strptime(strftime(_time, "%Y-%m-%dT%H:%M:%S.%3N")."UCT", "%Y-%m-%dT%H:%M:%S.%3N%Z")
| where _time>relative_time(now(), "-1h") AND _time<now()
If this comment/answer was helpful, please up vote it. Thank you.
0 Karma

somesoni2
SplunkTrust
SplunkTrust

You would need to setup timestamp parsing for your log (sourcetype) so that Splunk knows that logged timestamp is in UST (GMT/UTC).
https://docs.splunk.com/Documentation/Splunk/7.2.5/Data/Configuretimestamprecognition

If you could you update your logging format to include the timezone it's logging, it'll resolve the issue (without any timestamp parsing configuration, thought they are recommended). If you can't update the logging format, then you've to setup those time parsing configuration, including TZ=UTC attribute)

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...