Splunk Search

timestamp issue


I have issue with timestamp, here is the problem:
every day at "1 AM" all log files copy into the logserver. this logs belong to the yesterday but splunk consider today date (import date) as timestamp!

1-as you see in screenshot logfile name is 20200310.bz2 but timestamp is 3/11/20 (log belong yesterday but import today).
2-as you see in screenshot every line start with time not date and I can't use timestamp of events.

now question is how can I handle this with splunk?

alt text

0 Karma


"Archive files (such as a .tar or .zip file, are decompressed before being indexed."

So it is reading the timestamp of the recorded event and not the timestamp of the source file.

If you would like to extract the timestamp when the bz2 file is created, use this splunk answer:

Unless you've a specific use case where the timestamp of the source file is needed, would recommend, using the event time, because all your events will be occurring at 1am. With millions of record to search through, it will quickly turn into a pain point.

0 Karma


1-bz2 file create next day so not resolve issue if we consider create date of file.
2-this log file only store time of event not date (application create a log file each day, and file name is today date and every line of log file start with time.)

file name = 20200311
01:00:00 info logmessage
02:00:00 info logmessage
03:00:00 info logmessage

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...