Splunk Search

Time conversion from UST to EST in search results


Hello Team,

I am facing this issue where my logs are written in EST and the time stamp on the log is UST ( Lets say the log is written at 6PM EST and the time stamp in the log is 11PM). I am searching the logs in EST time zone. 2019-04-06 22:59:45.3711 is the timestamp format on the LOG

So the log written at 6PM EST having time stamp at 11pm isn't showing up in search until 11pm EST. I am not sure how to fix this thing. Any help is greatly appreciated.

I changed the time zone in my account to Eastern.

Tags (1)
0 Karma


This won't fix the root cause of the problem that @somesoni2 mentioned, which is that you the sourcetype is not setup with an offset as explained in the documentation, but it can make the _time appear accurately as a search time work around. This can be used to show results from the last hour

Search with UCT earliest=now latest=+4h
| eval _time=strptime(strftime(_time, "%Y-%m-%dT%H:%M:%S.%3N")."UCT", "%Y-%m-%dT%H:%M:%S.%3N%Z")
| where _time>relative_time(now(), "-1h") AND _time<now()
If this comment/answer was helpful, please up vote it. Thank you.
0 Karma

Revered Legend

You would need to setup timestamp parsing for your log (sourcetype) so that Splunk knows that logged timestamp is in UST (GMT/UTC).

If you could you update your logging format to include the timezone it's logging, it'll resolve the issue (without any timestamp parsing configuration, thought they are recommended). If you can't update the logging format, then you've to setup those time parsing configuration, including TZ=UTC attribute)

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...