Hi, I have some data in an index where the events all begin with a UTC timestamp. My Splunk indexer server is in the UK and I would like the timestamps for these events to be interpreted as being in the Splunk indexer timezone (UK) instead of the UTC. How can I do this? At present, if a new event arrives at 11AM UK time, the timestamp will say 10AM which is the UTC time so it means that any searches that I do over the last 60 minutes or less will return no results which should not be the case. Thanks in advance for your help. ... View more

Hey, I have an index where each event starts with a UTC timestamp. It is using this UTC timestamp for the _time field. Instead I would like for all events in this index to use the Splunk server timezone for the _time field. How can I configure Splunk to do this? Thanks. ... View more

Hey, I have a question about the transaction search command. If I am using a transaction on an event that has two timestamps in it, how can I access/use both of the timestamps after the transaction is done for start and finish times? Here's an example of one event that has two timestamps in it. 1342541754952 environment="prodemea" event_type="JobStarting" component="Job Controller" job_id="cf430a0b-bfcd-4765-891d-253da3607135" 1342541758729 environment="prodemea" event_type="JobCompleted" component="Job Controller" job_id="cf430a0b-bfcd-4765-891d-253da3607135" Here's the search that I am doing: index=prod (event_type="jobStarting" OR event_type="JobCompleted") | transaction job_id | table _time duration job_id The result of the search gives me the start time (_time), the duration of the transaction and the job_id. How can I also get the finish time? (which in this case would be 1342541758729) Thanks in advance for your help. ... View more

Hi, I am just looking at a new data input in Splunk. In some cases I am seeing one timestamp per event which is what I would expect to see but in some cases, Splunk is placing all of the following under one event: e.g. of one event in Splunk which has multiple timestamps: 2012-07-02 15:43:33.319, TZ="UTC", OsVersion="Microsoft Windows NT 6.1 Service Pack 1" 2012-07-02 15:43:33.531, TZ="UTC", OsVersion="Microsoft Windows NT 6.1 Service Pack 1" 2012-07-02 15:43:33.744, TZ="UTC", OsVersion="Microsoft Windows NT 6.1 Service Pack 1" Ideally, Splunk should be showing this as three separate events and not one event where _time is 2012-07-02 15:43:33.319. How can this event to be chopped into three events with the three timestamps? How would this be done in props.conf? Thanks in advance for your help ... View more