<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Why is event time different from server time? in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/Why-is-event-time-different-from-server-time/m-p/614894#M106375</link>
    <description>&lt;P&gt;Hi all,&lt;/P&gt;
&lt;P&gt;we have migrated HF where DB connect app was installed and now events from DB app on new HF have different timestamp. 1 hour is missing from server time.&lt;/P&gt;
&lt;P&gt;They are using same indexers. There is not TZ configured in props.conf on indexers.&lt;/P&gt;
&lt;P&gt;Those configurations in DB app do not work:&lt;BR /&gt;&lt;SPAN&gt;1. Configuration -&amp;gt; Databases -&amp;gt; Connections -&amp;gt; "your connection" (Timezone dropdown)&lt;/SPAN&gt;&lt;/P&gt;
&lt;P&gt;2.&amp;nbsp;&lt;SPAN&gt;Add the following to the JVM options in the configuration tab of the DB connect app:&lt;/SPAN&gt;&lt;BR /&gt;&lt;SPAN&gt;-Duser.timezone=GMT&lt;BR /&gt;&lt;/SPAN&gt;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;&lt;SPAN&gt;New HF:&lt;/SPAN&gt;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;&lt;SPAN&gt;1. The time should be 3:30 as server/hf has EDT time 3:30 (This works correctly on old HF, there is time t-6, not t-7). &lt;STRONG&gt;If this is not time from server/when was event created what is it then? I am confused here.&lt;BR /&gt;&lt;/STRONG&gt;9:30 is ok, as we are CET.&lt;/SPAN&gt;&lt;/P&gt;
&lt;P&gt;&lt;SPAN&gt;&amp;nbsp;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="new_event_time.PNG" style="width: 400px;"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/21724i4775B46BCF95B01F/image-size/medium?v=v2&amp;amp;px=400" role="button" title="new_event_time.PNG" alt="new_event_time.PNG" /&gt;&lt;/span&gt;&lt;/SPAN&gt;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;&lt;SPAN&gt;2.&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="new_time.PNG" style="width: 400px;"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/21725iAAC39459E1D07514/image-size/medium?v=v2&amp;amp;px=400" role="button" title="new_time.PNG" alt="new_time.PNG" /&gt;&lt;/span&gt;&lt;/SPAN&gt;&lt;/P&gt;
&lt;P&gt;&lt;SPAN&gt;3. &lt;STRONG&gt;The server time of new HF is correct. So why events miss 1 hour?&amp;nbsp;&lt;/STRONG&gt;&lt;/SPAN&gt;&lt;/P&gt;
&lt;P&gt;&lt;SPAN&gt;&amp;nbsp;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="new_server_time.PNG" style="width: 400px;"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/21726iE6E10578C0C286FF/image-size/medium?v=v2&amp;amp;px=400" role="button" title="new_server_time.PNG" alt="new_server_time.PNG" /&gt;&lt;/span&gt;&lt;/SPAN&gt;&lt;/P&gt;
&lt;P&gt;&lt;SPAN&gt;&lt;BR /&gt;Old HF:&lt;/SPAN&gt;&lt;/P&gt;
&lt;P&gt;&lt;SPAN&gt;1.&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="old_event_time.PNG" style="width: 400px;"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/21721iF776BBA2A1F2566C/image-size/medium?v=v2&amp;amp;px=400" role="button" title="old_event_time.PNG" alt="old_event_time.PNG" /&gt;&lt;/span&gt;&lt;/SPAN&gt;&lt;/P&gt;
&lt;P&gt;&lt;SPAN&gt;&lt;BR /&gt;2.&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="old_time.PNG" style="width: 400px;"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/21722i932812698410AEE8/image-size/medium?v=v2&amp;amp;px=400" role="button" title="old_time.PNG" alt="old_time.PNG" /&gt;&lt;/span&gt;&lt;/SPAN&gt;&lt;/P&gt;
&lt;P&gt;&lt;SPAN&gt;3.timedatectl (I took ss 9 mins later)&lt;BR /&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="timedatectl.PNG" style="width: 400px;"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/21723iB7128D0E38B96EA5/image-size/medium?v=v2&amp;amp;px=400" role="button" title="timedatectl.PNG" alt="timedatectl.PNG" /&gt;&lt;/span&gt;&lt;BR /&gt;&lt;BR /&gt;&lt;/SPAN&gt;&lt;/P&gt;
&lt;P&gt;&lt;SPAN&gt;Thank you for every idea.&lt;/SPAN&gt;&lt;/P&gt;</description>
    <pubDate>Wed, 28 Sep 2022 15:44:20 GMT</pubDate>
    <dc:creator>Sept11</dc:creator>
    <dc:date>2022-09-28T15:44:20Z</dc:date>
    <item>
      <title>Why is event time different from server time?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Why-is-event-time-different-from-server-time/m-p/614894#M106375</link>
      <description>&lt;P&gt;Hi all,&lt;/P&gt;
&lt;P&gt;we have migrated HF where DB connect app was installed and now events from DB app on new HF have different timestamp. 1 hour is missing from server time.&lt;/P&gt;
&lt;P&gt;They are using same indexers. There is not TZ configured in props.conf on indexers.&lt;/P&gt;
&lt;P&gt;Those configurations in DB app do not work:&lt;BR /&gt;&lt;SPAN&gt;1. Configuration -&amp;gt; Databases -&amp;gt; Connections -&amp;gt; "your connection" (Timezone dropdown)&lt;/SPAN&gt;&lt;/P&gt;
&lt;P&gt;2.&amp;nbsp;&lt;SPAN&gt;Add the following to the JVM options in the configuration tab of the DB connect app:&lt;/SPAN&gt;&lt;BR /&gt;&lt;SPAN&gt;-Duser.timezone=GMT&lt;BR /&gt;&lt;/SPAN&gt;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;&lt;SPAN&gt;New HF:&lt;/SPAN&gt;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;&lt;SPAN&gt;1. The time should be 3:30 as server/hf has EDT time 3:30 (This works correctly on old HF, there is time t-6, not t-7). &lt;STRONG&gt;If this is not time from server/when was event created what is it then? I am confused here.&lt;BR /&gt;&lt;/STRONG&gt;9:30 is ok, as we are CET.&lt;/SPAN&gt;&lt;/P&gt;
&lt;P&gt;&lt;SPAN&gt;&amp;nbsp;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="new_event_time.PNG" style="width: 400px;"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/21724i4775B46BCF95B01F/image-size/medium?v=v2&amp;amp;px=400" role="button" title="new_event_time.PNG" alt="new_event_time.PNG" /&gt;&lt;/span&gt;&lt;/SPAN&gt;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;&lt;SPAN&gt;2.&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="new_time.PNG" style="width: 400px;"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/21725iAAC39459E1D07514/image-size/medium?v=v2&amp;amp;px=400" role="button" title="new_time.PNG" alt="new_time.PNG" /&gt;&lt;/span&gt;&lt;/SPAN&gt;&lt;/P&gt;
&lt;P&gt;&lt;SPAN&gt;3. &lt;STRONG&gt;The server time of new HF is correct. So why events miss 1 hour?&amp;nbsp;&lt;/STRONG&gt;&lt;/SPAN&gt;&lt;/P&gt;
&lt;P&gt;&lt;SPAN&gt;&amp;nbsp;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="new_server_time.PNG" style="width: 400px;"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/21726iE6E10578C0C286FF/image-size/medium?v=v2&amp;amp;px=400" role="button" title="new_server_time.PNG" alt="new_server_time.PNG" /&gt;&lt;/span&gt;&lt;/SPAN&gt;&lt;/P&gt;
&lt;P&gt;&lt;SPAN&gt;&lt;BR /&gt;Old HF:&lt;/SPAN&gt;&lt;/P&gt;
&lt;P&gt;&lt;SPAN&gt;1.&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="old_event_time.PNG" style="width: 400px;"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/21721iF776BBA2A1F2566C/image-size/medium?v=v2&amp;amp;px=400" role="button" title="old_event_time.PNG" alt="old_event_time.PNG" /&gt;&lt;/span&gt;&lt;/SPAN&gt;&lt;/P&gt;
&lt;P&gt;&lt;SPAN&gt;&lt;BR /&gt;2.&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="old_time.PNG" style="width: 400px;"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/21722i932812698410AEE8/image-size/medium?v=v2&amp;amp;px=400" role="button" title="old_time.PNG" alt="old_time.PNG" /&gt;&lt;/span&gt;&lt;/SPAN&gt;&lt;/P&gt;
&lt;P&gt;&lt;SPAN&gt;3.timedatectl (I took ss 9 mins later)&lt;BR /&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="timedatectl.PNG" style="width: 400px;"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/21723iB7128D0E38B96EA5/image-size/medium?v=v2&amp;amp;px=400" role="button" title="timedatectl.PNG" alt="timedatectl.PNG" /&gt;&lt;/span&gt;&lt;BR /&gt;&lt;BR /&gt;&lt;/SPAN&gt;&lt;/P&gt;
&lt;P&gt;&lt;SPAN&gt;Thank you for every idea.&lt;/SPAN&gt;&lt;/P&gt;</description>
      <pubDate>Wed, 28 Sep 2022 15:44:20 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Why-is-event-time-different-from-server-time/m-p/614894#M106375</guid>
      <dc:creator>Sept11</dc:creator>
      <dc:date>2022-09-28T15:44:20Z</dc:date>
    </item>
  </channel>
</rss>

