different timestamp displayed in log file than splunk timestamp

[ravinder82]

Hi Team,

i am facing the issue of different timezones. Splunk timezone is CET but log event timezone is coming as UTC in my localhost access logs but other log event are displaying the timezone in sync with CET timezone.

Splunk timestamp is 6/11/13 11:31:44:000 AM
Event log timestamp is [11/Jun/2013:09:31:44 +0000]

I need event timestamp in CET timezone. Is there any way to do it in search query by making offset of 2 hours

Kindly help.

Thanks

[kristian_kolb]

eeh, it seems like this is handled correctly. You are in CET, and the events that have timestamps set in another zone gets this 'corrected', thus the 2 hour difference.

[martin_mueller]

You can set a timezone by host or sourcetype when indexing to get the timestamps correct right away: http://docs.splunk.com/Documentation/Splunk/5.0.3/data/Applytimezoneoffsetstotimestamps

[martin_mueller]

Once indexed, you cannot change the events.
Searching through an extra two hours, recalculating the timestamp, and re-filtering mid-search is not a great idea either - apart from lost performance that's a horrible pitfall for errors and a maintenance nightmare.

Get things indexed correctly, even if it may involve some convincing of third parties.

[ravinder82]

Thanks Martin for the information.

But problem with me is i am not admin of Splunk portal. It is configured and maintained by third party. Hence i cant change the settings and hard to convince them as timezone in other source files like error logs, catalina.out logs are in CET timezone which is correct.

Only localhost log access event are in different timezone as i posted.

Is there any way to correct the timezone to CET only in splunk search query.

Thanks