- Splunk Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Time Zone issue
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Time Zone issue
Hi All,
We have application logs configured to Splunk. When I search for the last 15min there were no results but when I search for the last one hour it gave so many events. Upon checking it, I came to know that there is an time zone issue and have configured time zone configurations for these logs in props.conf. Even after that the issue persists. Could you please help me in checking what might be other issues in this case and what will be the configurations to be deployed in this case?
Thank you in advance.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Have you verified how long it is taking the events to get indexed? Time zone issues usually work in terms of whole hours. (Yes, there are exceptions, but it's not the way to bet.)
Also, when checking recent events and suspecting time zone issues, try setting latest=+3d just in case your indexers are future-dating anything.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @DalJeanis, I have calculated the difference between _indextime and _time, it is giving a negative number more than 3600. But not sure how to calculate the time taken for the events to get indexed. Could you please help me with the query to calculate it? Thank you in advance.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi siva_cg,
Can you provide a couple sample (and anonymized) events and your configs so we can assist?
Otherwise I recommend using the add data wizard to ensure your configurations are sound.
https://docs.splunk.com/Documentation/Splunk/6.6.2/Data/Howdoyouwanttoadddata
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
When you says the issue persists after changing props.conf are you referring to new events or existing events?
Changing props.conf will have no effect on data already indexed.
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @richgalloway, I am referring to new events only. There is no effect on new events also.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Like mmodestino suggests, Posting your props.conf settings will help us determine if you have something set wrong.
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @richgalloway, @mmodestino, my props.conf for these logs are so simply and it looks as below:
[source::.../logpath/]
TZ = UTC
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@siva_cg, the events timestamp _time displayed in Splunk will be based on logged in User's Timezone Settings. Can you try to set the same using the following documentation and check?
http://docs.splunk.com/Documentation/Splunk/latest/Security/ConfigureuserswithSplunkWeb
| makeresults | eval message= "Happy Splunking!!!"
Extending Observability Content to Splunk Cloud
More Control Over Your Monitoring Costs with Archived Metrics!
New in Observability Cloud - Explicit Bucket Histograms
