Splunk doesn't recognize timestamp properly when importing data from DB

ArsenyKapralov — Mon, 25 Aug 2014 16:00:02 GMT

I'm importing simple events from Oracle table. I don't have specific field with timestamp in database table and while I'm trying to import data I have a GMT time in the timestamp except GMT+4 as my (and server) timezone should be.

I tried to fix this with such code in props.conf in etc/system/local but didn't succeed:

[sourcetype_name]
TZ=Europe/Moscow

How can I fix this and make correct timestamps?

Re: Splunk doesn't recognize timestamp properly when importing data from DB

pmdba — Tue, 23 Sep 2014 22:55:03 GMT

If your database is on the correct time zone and you haven't figured out any other way to get Splunk to adjust, I'd recommend adding the timestamp to your SQL query, based on sysdate, so that it comes into Splunk with the proper local timezone adjustment:

select to_char(sysdate,'DD-MM-YYYY HH24:MI:SS') "time", ...

topic Splunk doesn't recognize timestamp properly when importing data from DB in Getting Data In

Splunk doesn't recognize timestamp properly when importing data from DB

Re: Splunk doesn't recognize timestamp properly when importing data from DB