Community:Search Report: How To Analyze parsed Timestamp Vs original Timestamp in an event
From Splunk Wiki
How To Analyze Parsed Timestamp Vs Original Timestamp in an Event
This is a useful search when you want to analyze if a timestamp parsed at index time was correct by comparing it with original time stamp in an event.
At first, we should keep in mind that Splunk use epoch time to store time stamp. So, depending on system clock, a search checks a time range or a time stamp will be displayed based on the system clock time
#
# How to verify if a timestamp was parsed correctly from original event
#
#
# Test conditon
#
1. Events has UTC timeszone timestamp
-Example
Wed, 17 Apr 2013 23:42:29 UTC DEBUG: Read C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_vcenter\local\inputs.conf
Wed, 17 Apr 2013 22:42:29 UTC DEBUG: mod: Fri Dec 14 14:46:12 PST 2012
Wed, 17 Apr 2013 21:42:29 UTC DEBUG: Read C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_vcenter\local\inputs.conf
Wed, 17 Apr 2013 20:42:29 UTC DEBUG: mod: Fri Dec 14 14:46:12 PST 2012
2. Splunk is running on a server in PDT (-7hours)
#
# Verifying timestamp comparing orignal and indexed timestamp
#
#Search
index=main UTC source="C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_vcenter\\bin\\SetHost.bat"
| eval TT=_time
| eval Time=strftime(_time, "%m/%d/%y %H:%M:%S %z")
| rex "^\w+, (?<origTimestamp>.+?)\s+DEBUG"
| eval origTimestamp_A=round(strptime(origTimestamp, "%d %h %Y %H:%M:%S %Z"), 0)
| eval Diff=round(_time, 0)-origTimestamp_A
| table _time Time origTimestamp Diff origTimestamp_A TT
# ./bin/splunk search 'index=main UTC source="C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_vcenter\\bin\\SetHost.bat"
> | eval TT=_time
> | eval Time=strftime(_time, "%m/%d/%y %H:%M:%S %z")
> | rex "^\w+, (?<origTimestamp>.+?)\s+DEBUG"
> | eval origTimestamp_A=round(strptime(origTimestamp, "%d %h %Y %H:%M:%S %Z"), 0)
> | eval Diff=round(_time, 0)-origTimestamp_A
> | table _time Time origTimestamp Diff origTimestamp_A TT
> ' -auth admin:changeme1
_time Time origTimestamp Diff origTimestamp_A TT
--------------------------- ----------------------- ------------------------ ---- --------------- ----------
2013-04-17 16:42:29.000 PDT 04/17/13 16:42:29 -0700 17 Apr 2013 23:42:29 UTC 0 1366242149 1366242149
2013-04-17 15:42:29.000 PDT 04/17/13 15:42:29 -0700 17 Apr 2013 22:42:29 UTC 0 1366238549 1366238549
2013-04-17 14:42:29.000 PDT 04/17/13 14:42:29 -0700 17 Apr 2013 21:42:29 UTC 0 1366234949 1366234949
2013-04-17 13:42:29.000 PDT 04/17/13 13:42:29 -0700 17 Apr 2013 20:42:29 UTC 0 1366231349 1366231349
#
# Check time different by not-calculation timezone in original timestamp and compare it with indexed timestamp
#
# Search
index=main UTC source="C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_vcenter\\bin\\SetHost.bat"
| eval TT=_time
| eval Time=strftime(_time, "%m/%d/%y %H:%M:%S %z")
| rex "^\w+, (?<origTimestamp>.+?)\s+DEBUG"
| eval origTimestamp_A=round(strptime(origTimestamp, "%d %h %Y %H:%M:%S"), 0)
| eval Diff=round((round(_time, 0)-origTimestamp_A)/60/60, 0)
| table _time Time origTimestamp Diff origTimestamp_A TT
# Run the search in CLI
=> Can verify UTC -7 hours right now as PDT
# ./bin/splunk search 'index=main UTC source="C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_vcenter\\bin\\SetHost.bat"
| eval TT=_time
| eval Time=strftime(_time, "%m/%d/%y %H:%M:%S %z")
| rex "^\w+, (?<origTimestamp>.+?)\s+DEBUG"
| eval origTimestamp_A=round(strptime(origTimestamp, "%d %h %Y %H:%M:%S"), 0)
| eval Diff=round((round(_time, 0)-origTimestamp_A)/60/60, 0)
| table _time Time origTimestamp Diff origTimestamp_A TT' -auth admin:changeme1
_time Time origTimestamp Diff origTimestamp_A TT
--------------------------- ----------------------- ------------------------ ---- --------------- ----------
2013-04-17 16:42:29.000 PDT 04/17/13 16:42:29 -0700 17 Apr 2013 23:42:29 UTC -7 1366267349 1366242149
2013-04-17 15:42:29.000 PDT 04/17/13 15:42:29 -0700 17 Apr 2013 22:42:29 UTC -7 1366263749 1366238549
2013-04-17 14:42:29.000 PDT 04/17/13 14:42:29 -0700 17 Apr 2013 21:42:29 UTC -7 1366260149 1366234949
2013-04-17 13:42:29.000 PDT 04/17/13 13:42:29 -0700 17 Apr 2013 20:42:29 UTC -7 1366256549 1366231349
