Getting Data In

How can I compare the time on our server against the actual current time?

kiran331
Builder

Hi

Is there a way to find the current time on the Windows (UF installed) and compare it with the current time? I need to find the time variances in Windows Environment?

0 Karma

robgora_deloitt
Path Finder

Have you tried the NTP Statistics for Windows and Linux?

https://splunkbase.splunk.com/app/3155/

0 Karma

krishnab
Path Finder

Hi Kiran,

Not Possible.

The reason is: Your Uf will collect data in the Server timezone(windows),but when the data is forwarded to indexers,the timestamp of the data will be changed to that of indexers time.Later when you search that event from SH,it will change to your profile's Timezone.

so there is lot of changes to your event time,Now if you have the one instance,then you can convert the time to epoch and add/substract from the epoch time to get the instance time.But what if you have instances in multiple timeZone??
So it is better to have a common timezone(GMT) rather than the instance time.

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi kiran331,

May not be the best answer, but at least an idea:
On the forwarder create a scripted input http://docs.splunk.com/Documentation/Splunk/latest/AdvancedDev/ScriptedInputsIntro that polls the current system time and puts it into a value of a field of your choice. This way you can index the time on the windows machine running the UF.

In Splunk Enterprise then need a scripted input or custom search command http://docs.splunk.com/Documentation/Splunk/latest/Search/AddthecustomcommandtoSplunk to poll/query a NTP server to be able to compare it with the time from the UF.

But, my advise would be a different approach.

Instead of hunting wrong times, why not check if NTP is configured on your windows machine? First configure NTP for all machines and then check if any of them are out of sync. Maybe this blog post can help https://blogs.technet.microsoft.com/heyscriptingguy/2015/05/27/powershell-time-sync-get-and-evaluate... ?

Sorry not a windows person, just trying to be helpful 🙂

Cheers, MuS

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...