Getting Data In

How to fix an incorrectly indexed timestamp?

mholden37
Engager

Splunk is not showing the correct time on the events. The time that Splunk gives the log is 5 hours behind the time that it is supposed to be. The time is correct on the server and the logs but Splunk is saying it is 5 hours behind. For the below timestamp it is giving it a time of 8:48:06.000 AM when it should be 1:48:06.000PM.

2017-02-22T13:48:06Z

In props.conf I have TIME_FORMAT=%Y-%m-%dT%H:%M:%SZ

I have also tried changing the timezone to TZ = UTC and that did not fix it.

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

If your Splunk is in the US eastern time zone then 13:48:06Z correctly converts to 08:48:06 EST. The "Z" says the timestamp is in UTC so Splunk converts it to the local time zone. If that is not the expected behavior then change the server to specify the correct time zone in its events.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

aaraneta_splunk
Splunk Employee
Splunk Employee

@mholden37 - Did one of the answers below help provide a solution your question? If yes, please click “Accept” below the best answer to resolve this post and upvote anything that was helpful. If no, please leave a comment with more feedback. Thanks.

0 Karma

sloshburch
Splunk Employee
Splunk Employee

What happens when you set the time to be parsed automatically?
Alternatively, try using the strptime to validate the string parsing.
For example, you could also try %FT%TZ as per https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Commontimeformatvariables

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If your Splunk is in the US eastern time zone then 13:48:06Z correctly converts to 08:48:06 EST. The "Z" says the timestamp is in UTC so Splunk converts it to the local time zone. If that is not the expected behavior then change the server to specify the correct time zone in its events.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...