Bad timestamp DB Connect

[paola92]

Hi,

I configured a new input for DB connect and specified used the column end_time for timestamp but when I received the events the timestamps has 5 hours minus like this:

I need help!! Others two inputs works fine but the other that I created (5) has the same issue.

[Sukisen1981]

hi @paola92
this does look like an issue with timezones.
if splunk is logging this event at 11:42 there is no way this can actually end at 16:42 , irrespective of how the field end_time gets populated unless...
your event occurs at a different timezone from the one where your splunk is running..
Can you check the above out, you can set timezones quite easily ref
https://docs.splunk.com/Documentation/Splunk/7.3.1/Data/Applytimezoneoffsetstotimestamps

[Sukisen1981]

hi @paola92
Can you please check and confirm?

[paola92]

The issue was solved when I put the timezone in the connection configuration.