Getting Data In

Timestamp mismatch occurring from events with the Splunk timestamp .

guru865
Path Finder

Hi Please help me fix this would like to consider the TIME stamp extracted from the events , but i see two different time format s in events as you can see in below events .
And , the search head settings has default time zone settings --- CST zone .
Here is the props.conf i have written . Please help me parse the correct time stamp.

[smr]
pulldown_type = true
NO_BINARY_CHECK=true
disabled=false
SHOULD_LINEMERGE=true
MAX_TIMESTAMP_LOOKAHEAD=150
MAX_EVENTS=15000
TRUNCATE=100000

alt text

0 Karma
1 Solution

guru865
Path Finder

I can see that the time off set with the actual events and the splunk time zone has 1 and half hour difference . one hours 30 mins diff.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...