Splunk Search

Why is imported error log producing wrong time and date stamps in results


Just installed Splunk Enterprise free edition on a Windows 10 computer.

Downloaded a Wordpress error log from a decade old website.

Settings - Add Data - Upload File - uploaded the server error log ( 365 megs) - clicked through the default settings. Once imported I went back to the search page.

Ran the following command:

sourcetype="server-error-log-1" earliest="11/12/2018:0:0:0" latest="09/12/2019:0:0:0"

Time column says:
11:01:00.000 PM

First entry in the event column is:
[13-Jan-2010 23:01:00]

The thing is, the error log was imported on 9/12 and not 9/11.

Did I do something wrong when importing the error log?

The error log shows the date as 2010, which is what I want to search.

0 Karma


clicked through the default settings

When you're selecting the default settings, you need to configure the timestamp extraction to find the date for you and to properly break the events. You can either use a default sourcetype or create your own. Sometimes Splunk will automatically figure it out for you, but as you have found out, that's not always the case.

Overview: https://docs.splunk.com/Documentation/Splunk/latest/Data/Setsourcetype
More details: https://docs.splunk.com/Documentation/Splunk/latest/Data/Createsourcetypes


If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.
0 Karma


Thank you, that answers part of the question.

When the data was imported the date was 9/12, the Splunk date column said 9/11.

Why was the date column a day off from the actual day the data was imported?

Time.is says my system clock is 1.4 seconds ahead. And no, the data was not imported on 1 second before midnight.

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...