Splunk Search

timestamp issue

Path Finder

I have issue with timestamp, here is the problem:
every day at "1 AM" all log files copy into the logserver. this logs belong to the yesterday but splunk consider today date (import date) as timestamp!

1-as you see in screenshot logfile name is 20200310.bz2 but timestamp is 3/11/20 (log belong yesterday but import today).
2-as you see in screenshot every line start with time not date and I can't use timestamp of events.

now question is how can I handle this with splunk?

alt text

0 Karma


"Archive files (such as a .tar or .zip file, are decompressed before being indexed."

So it is reading the timestamp of the recorded event and not the timestamp of the source file.

If you would like to extract the timestamp when the bz2 file is created, use this splunk answer:

Unless you've a specific use case where the timestamp of the source file is needed, would recommend, using the event time, because all your events will be occurring at 1am. With millions of record to search through, it will quickly turn into a pain point.

0 Karma

Path Finder

1-bz2 file create next day so not resolve issue if we consider create date of file.
2-this log file only store time of event not date (application create a log file each day, and file name is today date and every line of log file start with time.)

file name = 20200311
01:00:00 info logmessage
02:00:00 info logmessage
03:00:00 info logmessage

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!