Why is imported error log producing wrong time and date stamps in results

[kfelts68]

Just installed Splunk Enterprise free edition on a Windows 10 computer.

Downloaded a Wordpress error log from a decade old website.

Settings - Add Data - Upload File - uploaded the server error log ( 365 megs) - clicked through the default settings. Once imported I went back to the search page.

Ran the following command:

sourcetype="server-error-log-1" earliest="11/12/2018:0:0:0" latest="09/12/2019:0:0:0"

Time column says:
Time
9/11/19
11:01:00.000 PM

First entry in the event column is:
[13-Jan-2010 23:01:00]

The thing is, the error log was imported on 9/12 and not 9/11.

Did I do something wrong when importing the error log?

The error log shows the date as 2010, which is what I want to search.

[jacobpevans]

clicked through the default settings

When you're selecting the default settings, you need to configure the timestamp extraction to find the date for you and to properly break the events. You can either use a default sourcetype or create your own. Sometimes Splunk will automatically figure it out for you, but as you have found out, that's not always the case.

Overview: https://docs.splunk.com/Documentation/Splunk/latest/Data/Setsourcetype
More details: https://docs.splunk.com/Documentation/Splunk/latest/Data/Createsourcetypes

[kfelts68]

Thank you, that answers part of the question.

When the data was imported the date was 9/12, the Splunk date column said 9/11.

Why was the date column a day off from the actual day the data was imported?

Time.is says my system clock is 1.4 seconds ahead. And no, the data was not imported on 1 second before midnight.