Time conversion from UST to EST in search results

[vn86893]

Hello Team,

I am facing this issue where my logs are written in EST and the time stamp on the log is UST ( Lets say the log is written at 6PM EST and the time stamp in the log is 11PM). I am searching the logs in EST time zone. 2019-04-06 22:59:45.3711 is the timestamp format on the LOG

So the log written at 6PM EST having time stamp at 11pm isn't showing up in search until 11pm EST. I am not sure how to fix this thing. Any help is greatly appreciated.

I changed the time zone in my account to Eastern.

[dmarling]

This won't fix the root cause of the problem that @somesoni2 mentioned, which is that you the sourcetype is not setup with an offset as explained in the documentation, but it can make the _time appear accurately as a search time work around. This can be used to show results from the last hour

Search with UCT earliest=now latest=+4h
| eval _time=strptime(strftime(_time, "%Y-%m-%dT%H:%M:%S.%3N")."UCT", "%Y-%m-%dT%H:%M:%S.%3N%Z")
| where _time>relative_time(now(), "-1h") AND _time<now()

[somesoni2]

You would need to setup timestamp parsing for your log (sourcetype) so that Splunk knows that logged timestamp is in UST (GMT/UTC).
https://docs.splunk.com/Documentation/Splunk/7.2.5/Data/Configuretimestamprecognition

If you could you update your logging format to include the timezone it's logging, it'll resolve the issue (without any timestamp parsing configuration, thought they are recommended). If you can't update the logging format, then you've to setup those time parsing configuration, including TZ=UTC attribute)