Getting Data In

Timezone issue

gilliers
Explorer

Hello,

I have a timezone issue that I don't understand.

I have two set of indexed logs in different indexes, indexed by the same indexer. The sourcetype is the same for both. I don't explicitly modify the timezone anywhere.


For the first index the _time shown is the right one (same as the one in the log itself).Server 1  - _time OKServer 1 - _time OK
For the second index the _time is 1 hour behind since the daylight saving time a few days ago. If I look at the _time field, it has however the right date_hour but it shows something different.Server2 - _time wrongServer2 - _time wrong

I checked on the servers where the logs are generated but they are running the same (and right) timezone: CET.

I am lost about this issue, any suggestions on where I should look?

Labels (1)
0 Karma
1 Solution

gilliers
Explorer

Hello,

Thank you for your replies.

Finally the "issue" was a bug in Splunk version, by restarting the universal forwarders all went back to normal.

I'm planning the upgrade right now so it should'nt happen again.

Good day.

View solution in original post

0 Karma

gilliers
Explorer

Hello,

Thank you for your replies.

Finally the "issue" was a bug in Splunk version, by restarting the universal forwarders all went back to normal.

I'm planning the upgrade right now so it should'nt happen again.

Good day.

0 Karma

PickleRick
Ultra Champion

https://docs.splunk.com/Documentation/Splunk/8.2.3/Knowledge/Usedefaultfields#Default_datetime_field...

"The datetime values are the literal values parsed from the event when it is indexed, regardless of its timezone"

That's why I'd rather believe _time (if your time extraction is working properly) than date_* fields.

0 Karma

gilliers
Explorer

Hello,

Thanks for your reply.

If I look at the raw datas, the datetime value in the log entry is the one expected, not the wrong one (16:27:16 for the second server, not 15:27:16).

Tags (1)
0 Karma

PickleRick
Ultra Champion

Yes. That's understandable. The date_hour field should correspond to the hour part from the raw event. "local" in date_zone suggests that the timestamp in raw event didn't have the timezone information.

Therefore - if you say that you don't explicitly manipulate timezone - the event must have been parsed according to the local time zone of the HF or indexer. And now the question I cannot answer is whether the data in the raw event is in your local timezone and is not recalculated correctly by the parser or is it sent with a wrong timezone.

Anyway, it looks that some explicit TZ setting could be useful.

0 Karma
Get Updates on the Splunk Community!

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...

Want a chance to win $500 to the Splunk shop? Take our IT Incident Management Survey!

  Top Trends & Best Practices in Incident ManagementSplunk is partnering up with Constellation Research to ...