I have a log with a custom time date stamp. I am running into an issue where the index time is exactly one hour ahead of the event time stamp in the log. Could this be an issue with how I defined the date stamp in my props? I should add that the application server and the splunk server are set to use CST and have the correct system time.
Here is a time stamp from the log
2014-06-04T11:38:15.190 CST
My props for the time stamp
[prd_ufo_stats]
TIME_PREFIX = ^
MAX_TIMESTAMP_LOOKAHEAD = 20
TIME_FORMAT = %Y-%m-%dT%H:%M:%S:%3N %Z
LINE_BREAKER = ([\r\n]+)
SHOULD_LINEMERGE = False
TRUNCATE = 100000
KV_MODE = None
Thanks!
This doc should help fix your time stamp issue
http://docs.splunk.com/Documentation/Splunk/6.1.1/Data/ApplyTimezoneOffsetsToTimeStamps
Missing something- the props for this sourcetype is on the search head so I made the change and added "TZ = US/Central" and then restarted the search head with no difference.
Do I need to drop %Z from the timestamp defined in props? Everything involved with the data stream is in CST so I am not sure why this is the issue other than the custom time date stamp.
Did this work? I'm facing same issue