Getting Data In

Timezone issue

gilliers
Explorer

Hello,

I have a timezone issue that I don't understand.

I have two set of indexed logs in different indexes, indexed by the same indexer. The sourcetype is the same for both. I don't explicitly modify the timezone anywhere.


For the first index the _time shown is the right one (same as the one in the log itself).Server 1  - _time OKServer 1 - _time OK
For the second index the _time is 1 hour behind since the daylight saving time a few days ago. If I look at the _time field, it has however the right date_hour but it shows something different.Server2 - _time wrongServer2 - _time wrong

I checked on the servers where the logs are generated but they are running the same (and right) timezone: CET.

I am lost about this issue, any suggestions on where I should look?

Labels (1)
0 Karma
1 Solution

gilliers
Explorer

Hello,

Thank you for your replies.

Finally the "issue" was a bug in Splunk version, by restarting the universal forwarders all went back to normal.

I'm planning the upgrade right now so it should'nt happen again.

Good day.

View solution in original post

0 Karma

gilliers
Explorer

Hello,

Thank you for your replies.

Finally the "issue" was a bug in Splunk version, by restarting the universal forwarders all went back to normal.

I'm planning the upgrade right now so it should'nt happen again.

Good day.

0 Karma

PickleRick
Ultra Champion

https://docs.splunk.com/Documentation/Splunk/8.2.3/Knowledge/Usedefaultfields#Default_datetime_field...

"The datetime values are the literal values parsed from the event when it is indexed, regardless of its timezone"

That's why I'd rather believe _time (if your time extraction is working properly) than date_* fields.

0 Karma

gilliers
Explorer

Hello,

Thanks for your reply.

If I look at the raw datas, the datetime value in the log entry is the one expected, not the wrong one (16:27:16 for the second server, not 15:27:16).

Tags (1)
0 Karma

PickleRick
Ultra Champion

Yes. That's understandable. The date_hour field should correspond to the hour part from the raw event. "local" in date_zone suggests that the timestamp in raw event didn't have the timezone information.

Therefore - if you say that you don't explicitly manipulate timezone - the event must have been parsed according to the local time zone of the HF or indexer. And now the question I cannot answer is whether the data in the raw event is in your local timezone and is not recalculated correctly by the parser or is it sent with a wrong timezone.

Anyway, it looks that some explicit TZ setting could be useful.

0 Karma
Get Updates on the Splunk Community!

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...