topic Re: Bad timestamp DB Connect in All Apps and Add-ons

Bad timestamp DB Connect

paola92 — Fri, 23 Aug 2019 21:51:21 GMT

Hi,

I configured a new input for DB connect and specified used the column end_time for timestamp but when I received the events the timestamps has 5 hours minus like this:

I need help!! Others two inputs works fine but the other that I created (5) has the same issue.

Re: Bad timestamp DB Connect

Sukisen1981 — Sat, 24 Aug 2019 10:28:57 GMT

hi @paola92
this does look like an issue with timezones.
if splunk is logging this event at 11:42 there is no way this can actually end at 16:42 , irrespective of how the field end_time gets populated unless...
your event occurs at a different timezone from the one where your splunk is running..
Can you check the above out, you can set timezones quite easily ref
https://docs.splunk.com/Documentation/Splunk/7.3.1/Data/Applytimezoneoffsetstotimestamps

Re: Bad timestamp DB Connect

Sukisen1981 — Mon, 26 Aug 2019 07:53:42 GMT

hi @paola92
Can you please check and confirm?

Re: Bad timestamp DB Connect

paola92 — Thu, 17 Oct 2019 21:12:18 GMT

The issue was solved when I put the timezone in the connection configuration.