Hi Splunk users,
I have a problem regarding Splunk showing incorrect timestamps:
Splunk pretty much shows me timestamps with a 5 hour delay. If an something is logged in the logs I monitor, it is logged in EST (it says GMT -5:00 though and I think that is the problem). However the log looks like this:
It reads GMT -5:00 in the log file and Splunk goes ahead and reads that and shows me the logs only 5 hours after the event occurs. The log file however is written in EST and not GMT.
I changed my props.conf to tell Splunk that we are in EST. What could I change in order for Splunk to just read the timestamp out of the log without GMT -5:00, because I think this where the problem comes from.
Also see my props.conf:
TRUNCATE = 10000
TIME_PREFIX = ^
TIME_FORMAT = %Y-%m-%d %H:%M:%S
MAX_TIMESTAMP_LOOKAHEAD = 29
TZ = America/New_York
I did not set these settings myself, except the TZ setting. So I don't know where the MAX_TIMESTAMP_LOOKAHEAD = 10, is coming from or the TIME_FORMAT.
Thank you very much for your help,
Oliver
I actually was able to fix it.
Once I put the props.conf settings also on the indexers, it started indexing correctly.
I am not sure why, but I now have the correct time.
I actually was able to fix it.
Once I put the props.conf settings also on the indexers, it started indexing correctly.
I am not sure why, but I now have the correct time.
I reckon the TIME_FORMAT string is wrong here ...
It should read TIME_FORMAT = %Y %b %d %H:%M:%S:%3N %Z