×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Ask a Question
SFOTC
New Member
Member since: ‎11-11-2020
‎11-12-2020
Community Statistics
Posts 3
Solutions 0
Karma Given 0
Karma Received 0
Member Since ‎11-11-2020
Activity Feed
Topics I've Started
View All

Re: Splunk timestamp offset GMT

by in Getting Data In
‎11-12-2020 07:41 AM
‎11-12-2020 07:41 AM
Thanks, we are a little closer to what we need, but I'm not sure if Splunk can do this.  Our event times are in: YY-DOY-HH:MM:SS (example: 20-316-23:16:36.36)  The above example relates to a date of: 11/11/20 7:16.36pm (a time of 00:00:00 represents 8:00PM and a rollover of the next day).  Can Splunk handle a format like this? ... View more

Re: Splunk timestamp offset GMT

by in Getting Data In
‎11-11-2020 06:33 PM
‎11-11-2020 06:33 PM
Ok, thank I will give that a try. What directory are the "indexers" placed? ... View more

Splunk timestamp offset GMT

by in Getting Data In
‎11-11-2020 01:15 PM
‎11-11-2020 01:15 PM
Good evening.  I have a ASCII event message that looks like the following: The timestamp is in GMT time.  When Splunk coverts the timestamp the result is off by 5 hours. For this event message, the resulting timestamp is "11/11/20 5:46:39.969 PM" but should really be "11/11/20 12:46:39.969 PM". I have the servers local time zone set to "UTC -5 Eastern Time".  I already created a "props.conf" file and placed the following "TZ=Etc/GMT0", but it did not change the Splunk time stamp.  INFO Stol 20-314-17:46:39.969: !!!!!!!!!INST Telemetry Started !!!!!! Thank for your assistance. ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
‎11-12-2020 04:52 PM