search time an hour plus

[adcom26]

Hello 

when i make a search i got an hour plus 

[gcusello]

Hi @adcom26,

you haven't to check the Splunk server time that's correct, but the server that's sending logs, probably it has a different time.

Ciao.

Giuseppe

[gcusello]

Hi @adcom26,

did you checked the timezone of the data source or the solar time, probably it's different than the one of your Splunk server.

Ciao.

Giuseppe

[adcom26]

I checked it. But is the same

[gcusello]

Hi @adcom26,

the one hour delay is continue or not? in other words: have you alwaus one hur delay or in some moments there's a delay of less than one hour?

if it isn't continue, see how the data are generated: if there's a script or how are generated the written files, because maybe there a delay in generation or copy.

If instead you have a continue delay of exactly one hour this is usually a timezone problem, see in the raw events if the timestamp of the event is the same of the time in the events, if it's the same check what's the real timezone of the data, if it's different, check the props.conf of your sourcetype.

Ciao.

Giuseppe

[adcom26]

HI @gcusello  

the one hour delay is continue

[gcusello]

Hi @adcom26,

as I said, check if the server has the correct time, maybe it hasn't the solar time.

Ciao.

Giuseppe