Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About sagar06
sagar06
Loves-to-Learn Lots
Member since:
07-11-2022
07-07-2023
Community Statistics
| Posts | 7 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 07-11-2022 |
Activity Feed
- Posted Re: Why is log time is showing 5 hours ahead of system time? on Getting Data In. 07-07-2023 08:01 AM
- Posted Re: Why is log time is showing 5 hours ahead of system time? on Getting Data In. 06-30-2023 06:57 AM
- Posted Re: Why is log time is showing 5 hours ahead of system time? on Getting Data In. 06-27-2023 08:24 AM
- Posted Re: Why is log time is showing 5 hours ahead of system time? on Getting Data In. 06-27-2023 07:13 AM
- Posted Re: Why is log time is showing 5 hours ahead of system time? on Getting Data In. 06-27-2023 06:26 AM
- Posted Re: Why is log time is showing 5 hours ahead of system time? on Getting Data In. 06-27-2023 04:15 AM
- Posted Why is log time is showing 5 hours ahead of system time? on Getting Data In. 06-26-2023 08:57 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 |
07-07-2023
08:01 AM
I have tried configuring TZ=UTC on props of universal forwarder as well as on Heavy forwarder, still it is showing event time as 5 hours ahead of index time.
... View more
06-30-2023
06:57 AM
Hi, The props.conf we have been using is on HF. I can see one app with datetime.xml and its props on UF, can I add the TZ properties into the props of the same app on UF? Or we need to remove DATETIME_CONFIG from UF's props? Thanks.
... View more
06-27-2023
08:24 AM
Hi, We have not set TZ value in default/props.conf on UF.
... View more
06-27-2023
07:13 AM
Hi Dural_yyz, Let me explain the issue again. UF server time is in cdt. I am using date command to check, output of date command is Tue Jun 27 06:11:40 CDT 2023 Now on same server in logs, time is showing 5 hours ahead of CDT time. below time it is showing. 27 Jun 2023 11:10:18 abcdgdgdggdgdgdgdgdgd 27 Jun 2023 11:11:18 ababcabcbdbcbadcsadsa Because of this time differences, event time in splunk is showing 5 hours ahead of index_time
... View more
06-27-2023
06:26 AM
Hi richgalloway, In first post, there is typo, it is not EDT, it should be CDT. Below is the props [xx:xxxxxxxx] SHOULD_LINEMERGE=false LINE_BREAKER=([\r\n]+)[^:]+\:\d+\:\d+ NO_BINARY_CHECK=true TIME_FORMAT=%d %b %Y %H:%M:%S TIME_PREFIX=^ TZ=UTC MAX_EVENTS=10000 MAX_TIMESTAMP_LOOKAHEAD=25 TRUNCATE=99999
... View more
06-27-2023
04:15 AM
Hi richgalloway, We have already tried time zones, still it is showing the event time as +5 hours. The timestamp format in log is below. 27 Jun 2023 11:10:18 abcdgdgdggdgdgdgdgdgd 27 Jun 2023 11:11:18 ababcabcbdbcbadcsadsa The system time is showing as Tue Jun 27 06:11:40 CDT 2023 There are 5 hours difference between log time and system time due to which in splunk the event time is showing as 5 hours ahead of index time. Please suggest how we can fix this.
... View more
06-26-2023
08:57 AM
The server we are monitoring log files is in EDT timezone, the indexers are in utc time zone.
the problem is logs are printing timestamp in log files which are 5 hours ahead of actual system time. (Example: system time is 6PM EDT then in log file time it is showing 11PM)
now when these events are getting indexed the event time is showing 5 hours ahead of index time as it is taking system time (EDT)and converting it to UTC.
what can be done to get the correct event time?
please help.
... View more
Labels
- Labels:
-
heavy forwarder
-
host
-
time
-
universal forwarder
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
07-07-2023
11:21 AM
|
