Getting Data In

Adjust timezone for epoch style timestamp

morgancrocker
Engager

I have some log data that uses timestamps in an epoch-like format, but the issue is that they are logged as if it were in a local timezone rather than UTC. For example, 1394203884 = 14:51:24 March 6 2014 PST.

For example:

ts="1394187680", ...
ts="1394187682", ...
ts="1394187682", ...
ts="1394187682", ...

I understand that this an epoch-like forma and should always refer to UTC, but in this case it does not. Is there any way to configure Splunk to use these fields as timestamps, but not assume that they are UTC?

Update:

I should have mentioned this in the original post, I will update it. I have tried this(props.conf) and use it with other inputs, but Splunk does not seem to apply any TZ settings in this case. I believe this is because it identifies the timestamp as epoch time and assumes it is in UTC.

Tags (3)
0 Karma

lukejadamec
Super Champion

No. There are a number of posts on the topic, and to summarize them: Epoch time is UTC, and since Splunk will use the raw event timezone if one exists then Splunk will always regard epoch times as UTC.

Some things you can try:

Use another timestamp in the event if one exists.

Correct the app that is generating the bad timestamp.

Preprocess the events to correct the timestamp before sending them to the indexer.

yannK
Splunk Employee
Splunk Employee

By definition Epoch time is UTC.

http://www.unixtimestamp.com/index.php

The unix time stamp is a way to track time as a running total of seconds. This count starts at the Unix Epoch on January 1st, 1970 at UTC.

So the only solution is to rewrite your timestamp before splunk reads it.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...