Splunk Search

Why is imported error log producing wrong time and date stamps in results


Just installed Splunk Enterprise free edition on a Windows 10 computer.

Downloaded a Wordpress error log from a decade old website.

Settings - Add Data - Upload File - uploaded the server error log ( 365 megs) - clicked through the default settings. Once imported I went back to the search page.

Ran the following command:

sourcetype="server-error-log-1" earliest="11/12/2018:0:0:0" latest="09/12/2019:0:0:0"

Time column says:
11:01:00.000 PM

First entry in the event column is:
[13-Jan-2010 23:01:00]

The thing is, the error log was imported on 9/12 and not 9/11.

Did I do something wrong when importing the error log?

The error log shows the date as 2010, which is what I want to search.

0 Karma


clicked through the default settings

When you're selecting the default settings, you need to configure the timestamp extraction to find the date for you and to properly break the events. You can either use a default sourcetype or create your own. Sometimes Splunk will automatically figure it out for you, but as you have found out, that's not always the case.

Overview: https://docs.splunk.com/Documentation/Splunk/latest/Data/Setsourcetype
More details: https://docs.splunk.com/Documentation/Splunk/latest/Data/Createsourcetypes


If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.
0 Karma


Thank you, that answers part of the question.

When the data was imported the date was 9/12, the Splunk date column said 9/11.

Why was the date column a day off from the actual day the data was imported?

Time.is says my system clock is 1.4 seconds ahead. And no, the data was not imported on 1 second before midnight.

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...