Getting Data In

How can I compare the time on our server against the actual current time?



Is there a way to find the current time on the Windows (UF installed) and compare it with the current time? I need to find the time variances in Windows Environment?

0 Karma

Path Finder

Have you tried the NTP Statistics for Windows and Linux?

0 Karma

Path Finder

Hi Kiran,

Not Possible.

The reason is: Your Uf will collect data in the Server timezone(windows),but when the data is forwarded to indexers,the timestamp of the data will be changed to that of indexers time.Later when you search that event from SH,it will change to your profile's Timezone.

so there is lot of changes to your event time,Now if you have the one instance,then you can convert the time to epoch and add/substract from the epoch time to get the instance time.But what if you have instances in multiple timeZone??
So it is better to have a common timezone(GMT) rather than the instance time.

0 Karma


Hi kiran331,

May not be the best answer, but at least an idea:
On the forwarder create a scripted input that polls the current system time and puts it into a value of a field of your choice. This way you can index the time on the windows machine running the UF.

In Splunk Enterprise then need a scripted input or custom search command to poll/query a NTP server to be able to compare it with the time from the UF.

But, my advise would be a different approach.

Instead of hunting wrong times, why not check if NTP is configured on your windows machine? First configure NTP for all machines and then check if any of them are out of sync. Maybe this blog post can help ?

Sorry not a windows person, just trying to be helpful 🙂

Cheers, MuS

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!