Splunk Search

Why is imported error log producing wrong time and date stamps in results

kfelts68
Explorer

Just installed Splunk Enterprise free edition on a Windows 10 computer.

Downloaded a Wordpress error log from a decade old website.

Settings - Add Data - Upload File - uploaded the server error log ( 365 megs) - clicked through the default settings. Once imported I went back to the search page.

Ran the following command:

sourcetype="server-error-log-1" earliest="11/12/2018:0:0:0" latest="09/12/2019:0:0:0"

Time column says:
Time
9/11/19
11:01:00.000 PM

First entry in the event column is:
[13-Jan-2010 23:01:00]

The thing is, the error log was imported on 9/12 and not 9/11.

Did I do something wrong when importing the error log?

The error log shows the date as 2010, which is what I want to search.

0 Karma

jacobpevans
Motivator

clicked through the default settings

When you're selecting the default settings, you need to configure the timestamp extraction to find the date for you and to properly break the events. You can either use a default sourcetype or create your own. Sometimes Splunk will automatically figure it out for you, but as you have found out, that's not always the case.

Overview: https://docs.splunk.com/Documentation/Splunk/latest/Data/Setsourcetype
More details: https://docs.splunk.com/Documentation/Splunk/latest/Data/Createsourcetypes

Cheers,
Jacob

If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.
0 Karma

kfelts68
Explorer

Thank you, that answers part of the question.

When the data was imported the date was 9/12, the Splunk date column said 9/11.

Why was the date column a day off from the actual day the data was imported?

Time.is says my system clock is 1.4 seconds ahead. And no, the data was not imported on 1 second before midnight.

0 Karma
Get Updates on the Splunk Community!

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...