Installation

Last update time is future time

happy035
Explorer

Hi there,

I am using Splunk 5, Few day ago, I migrated old splunk data to new server via file copy.
After moved all data, I restarted splunk server but from that time, Last Update time is in the future time.
My linux server time has been configured with KST(UTC +9:00). If linux server time is Mon Oct 7 16:28:06 KST 2013 but last update time, Last update time in Splunk is Mon Oct 8 10:34:47 KST 2013.
How do I fix this problem?

Tags (1)
0 Karma

markovic
Explorer

Did you find a fix for your problem? Now i got the same problem after moving the buckets.

0 Karma

happy035
Explorer

Hi markovic, Thanks for your interesting.
I have resolved this problem few days ago.
But my solution runs only in Ubuntu machine.

Please follow steps,
1. open "/etc/default/rcS" file
2. check this line if exists
assume that the BIOS clock is set to UTC time (recommended)
UTC=no
3. if UTC=Yes, Ubuntu server set up your localtime as UTC. I work in Asia. Because my local time is UTC, so I try to configure my loca time(UTC+9), all time stamp are future value.

Please change the value from UTC=yes to UTC=no.
Cheers~~

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...