What's the difference between StartTime and _time in Splunk?

1
votes

I've been looking at a recent event in Splunk with sourcetype WinHostMon, and I see two different values for StartTime and _time:

  • StartTime="20200427223006.448182-300"
  • _time is recorded as 2020-04-28T15:38:13.000-04:00

If the last part is timezone, there are two things that are strange about this:

  1. The timezone for StartTime is in the middle of the Atlantic.
  2. The times don't actually match.

Question: What is the actual time of this event, if such a thing can actually be determined, and what is causing the discrepancy between these two times?

(I tried to post this on Splunk Answers but they seem to have a labyrinth to stop people from signing up and I was unable to get an activated account.)

2
splunk
Might be worth cross-posting to Server Fault. - briantist
Yeah I wasn't sure which one this belonged in, and was almost about to post it there but I think I saw a Splunk query question here and an admin one there. I'll have to see what the preferred cross-posting protocol is. - Chris
fwiw .. -04:00 is EDT (or Atlantic Standard Time) - warren
Your question is posted on Splunk Answers. Either time could be correct or neither of them is. You'd have to look at the original source to know which. Having the props.conf settings for this source type might help. - RichG

2 Answers

1
votes

_time is the timestamp of the event, that is, when the event was generated or written to a log file. This is the field Splunk uses for default sorting and rendering in tables and time charts.

For WinHostMon events, most notably Process events, StartTime is when that process started.

Hence, it is not surprising that these events are significantly different. The process may have started at some point in the past, and then the WinHostMon input may generate a list of active processes every 5 minutes or so (or more or less)

0
votes

_time is the timestamp of the event as defined in props.conf - or, if undefined, whenever Splunk receives the event (as often happens with untagged JSON)

The field StartTime is - so far as I can tell - not related to whatever is populating _time

If you open the Add-On's props.conf, you'll see how they're defining the timestamp and the field extraction for StartTime