Getting Data In

How can I compare the time on our server against the actual current time?

kiran331
Builder

Hi

Is there a way to find the current time on the Windows (UF installed) and compare it with the current time? I need to find the time variances in Windows Environment?

0 Karma

robgora_deloitt
Path Finder

Have you tried the NTP Statistics for Windows and Linux?

https://splunkbase.splunk.com/app/3155/

0 Karma

krishnab
Path Finder

Hi Kiran,

Not Possible.

The reason is: Your Uf will collect data in the Server timezone(windows),but when the data is forwarded to indexers,the timestamp of the data will be changed to that of indexers time.Later when you search that event from SH,it will change to your profile's Timezone.

so there is lot of changes to your event time,Now if you have the one instance,then you can convert the time to epoch and add/substract from the epoch time to get the instance time.But what if you have instances in multiple timeZone??
So it is better to have a common timezone(GMT) rather than the instance time.

0 Karma

MuS
Legend

Hi kiran331,

May not be the best answer, but at least an idea:
On the forwarder create a scripted input http://docs.splunk.com/Documentation/Splunk/latest/AdvancedDev/ScriptedInputsIntro that polls the current system time and puts it into a value of a field of your choice. This way you can index the time on the windows machine running the UF.

In Splunk Enterprise then need a scripted input or custom search command http://docs.splunk.com/Documentation/Splunk/latest/Search/AddthecustomcommandtoSplunk to poll/query a NTP server to be able to compare it with the time from the UF.

But, my advise would be a different approach.

Instead of hunting wrong times, why not check if NTP is configured on your windows machine? First configure NTP for all machines and then check if any of them are out of sync. Maybe this blog post can help https://blogs.technet.microsoft.com/heyscriptingguy/2015/05/27/powershell-time-sync-get-and-evaluate... ?

Sorry not a windows person, just trying to be helpful 🙂

Cheers, MuS

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...