All Apps and Add-ons

Bad timestamp DB Connect

paola92
Explorer

Hi,

I configured a new input for DB connect and specified used the column end_time for timestamp but when I received the events the timestamps has 5 hours minus like this:
alt text

I need help!! Others two inputs works fine but the other that I created (5) has the same issue.

0 Karma

Sukisen1981
Champion

hi @paola92
this does look like an issue with timezones.
if splunk is logging this event at 11:42 there is no way this can actually end at 16:42 , irrespective of how the field end_time gets populated unless...
your event occurs at a different timezone from the one where your splunk is running..
Can you check the above out, you can set timezones quite easily ref
https://docs.splunk.com/Documentation/Splunk/7.3.1/Data/Applytimezoneoffsetstotimestamps

Sukisen1981
Champion

hi @paola92
Can you please check and confirm?

0 Karma

paola92
Explorer

The issue was solved when I put the timezone in the connection configuration.

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!