<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic DB Connect - Timezone Issue: Best Practices to avoid/identify? in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/DB-Connect-Timezone-Issue-Best-Practices-to-avoid-identify/m-p/113943#M23836</link>
    <description>&lt;P&gt;I'm going to explain this the best way possible. Our server running the indexer is located in EST. We are querying a database located in a different timezone and timestamping against epoch time, but the indexer seems to get the timestamp wrong and add 4 hours to it. Is there something we can do to make it use GMT time? What do you guys do to prevent timezone issues? Looking for best practices.&lt;/P&gt;</description>
    <pubDate>Thu, 09 Jul 2015 02:00:33 GMT</pubDate>
    <dc:creator>chawagon03</dc:creator>
    <dc:date>2015-07-09T02:00:33Z</dc:date>
    <item>
      <title>DB Connect - Timezone Issue: Best Practices to avoid/identify?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/DB-Connect-Timezone-Issue-Best-Practices-to-avoid-identify/m-p/113943#M23836</link>
      <description>&lt;P&gt;I'm going to explain this the best way possible. Our server running the indexer is located in EST. We are querying a database located in a different timezone and timestamping against epoch time, but the indexer seems to get the timestamp wrong and add 4 hours to it. Is there something we can do to make it use GMT time? What do you guys do to prevent timezone issues? Looking for best practices.&lt;/P&gt;</description>
      <pubDate>Thu, 09 Jul 2015 02:00:33 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/DB-Connect-Timezone-Issue-Best-Practices-to-avoid-identify/m-p/113943#M23836</guid>
      <dc:creator>chawagon03</dc:creator>
      <dc:date>2015-07-09T02:00:33Z</dc:date>
    </item>
    <item>
      <title>Re: DB Connect - Timezone Issue: Best Practices to avoid/identify?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/DB-Connect-Timezone-Issue-Best-Practices-to-avoid-identify/m-p/113944#M23837</link>
      <description>&lt;P&gt;The best best-practice is this:&lt;/P&gt;

&lt;P&gt;1: Always run host OS in GMT.&lt;BR /&gt;
2: Always timestamp source data in GMT.&lt;BR /&gt;
3: Always use NTP.&lt;/P&gt;

&lt;P&gt;In a perfect world, everybody would do that and things would be fine.  Short of that:&lt;/P&gt;

&lt;P&gt;1: Always explicitly timestamp (do not use &lt;CODE&gt;DATETIME_CONFIG=CURRENT&lt;/CODE&gt; nor &lt;CODE&gt;DATETIME_CONFIG=NONE&lt;/CODE&gt;).&lt;BR /&gt;
2: Always timestamp source data with per-event TZ.&lt;BR /&gt;
3: When that is not possible, always set a &lt;CODE&gt;TZ=&lt;/CODE&gt; value in &lt;CODE&gt;props.conf&lt;/CODE&gt; for everything (this can be verified by checking &lt;CODE&gt;date_zone&lt;/CODE&gt;; it should NEVER be &lt;CODE&gt;local&lt;/CODE&gt; but it is OK if it is &lt;CODE&gt;null&lt;/CODE&gt; for some &lt;CODE&gt;TA&lt;/CODE&gt; inputs).&lt;BR /&gt;
4: Always keep an eye on your calculated lag ( &lt;CODE&gt;_indextime&lt;/CODE&gt; - &lt;CODE&gt;_time&lt;/CODE&gt;) so you see when things go sideways.&lt;BR /&gt;
5: Always trackdown the reason any events have &lt;CODE&gt;timestamp=none&lt;/CODE&gt;.&lt;/P&gt;

&lt;P&gt;It sounds like you are having a type-3 problem.&lt;/P&gt;</description>
      <pubDate>Thu, 09 Jul 2015 04:10:54 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/DB-Connect-Timezone-Issue-Best-Practices-to-avoid-identify/m-p/113944#M23837</guid>
      <dc:creator>woodcock</dc:creator>
      <dc:date>2015-07-09T04:10:54Z</dc:date>
    </item>
    <item>
      <title>Re: DB Connect - Timezone Issue: Best Practices to avoid/identify?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/DB-Connect-Timezone-Issue-Best-Practices-to-avoid-identify/m-p/113945#M23838</link>
      <description>&lt;P&gt;Thank you! This was great and will hopefully solve future issues!&lt;/P&gt;</description>
      <pubDate>Thu, 09 Jul 2015 17:47:55 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/DB-Connect-Timezone-Issue-Best-Practices-to-avoid-identify/m-p/113945#M23838</guid>
      <dc:creator>chawagon03</dc:creator>
      <dc:date>2015-07-09T17:47:55Z</dc:date>
    </item>
  </channel>
</rss>

