topic Re: Splunk dbConnect inputs in Getting Data In

Splunk dbConnect inputs

chaitali_1994 — Fri, 07 Aug 2020 08:12:11 GMT

I am using Splunk dbConnect to collect data from database. While configuring the connection, set the timezone as Etc/GMT+1 : -01:00 as the logs generation time in database is GMT+1

When I was searching the data and searched for time difference, got time difference of 1 hour, _time is 1 hr ahead of indextime.

FYI: The database is in GMT+1

What is the difference between Etc/GMT+1 : -01:00 and Etc/GMT-1 : +01:00 ?

Thank you for any help!

Re: Splunk dbConnect inputs

thambisetty — Fri, 07 Aug 2020 10:40:40 GMT

Try choosing TZ GMT+1 not etc/gmt+1 in database connections.

Re: Splunk dbConnect inputs

chaitali_1994 — Fri, 07 Aug 2020 11:07:43 GMT

I do not see any TZ like GMT+1, its Etc/GMT+1: -01:00 and Etc/GMT-1:+01:00

Re: Splunk dbConnect inputs

thambisetty — Fri, 07 Aug 2020 11:48:10 GMT

choose based on your area. there are so many for +1, but don't choose the one with etc.