We are in Timezone Europe/Zurich, that is CEST+0200 including daytime savings. Since the switch to daytime savings on 29. March, we're having issues with the time conversion on our Splunk DB connect inputs. We've never configured specific timezone on the db connect app or on the inputs. Normally it just worked fine.
We have a multiple DB views, from which we read and then index into Splunk. This particual View has these four columns:
It is a follow tail input, rising column set to EVENTID. The timestamp ist extracted from the EVENTTIME column. The events are not updated, hence it's safe to index them with the follow tail method.
DB Input Setup
The input's SQL Query looks like this:
SELECT * FROM (SELECT * FROM "ONL"."DBG_EVENT_LOG" WHERE EVENT_TIME >= sysdate-1) t WHERE EVENT_ID > ? ORDER BY EVENT_ID ASC
WHERE EVENT_TIME >= sysdate-1 is there to improve query search time performance as it is a really big DB view.
The EVENT column contains several lines that belong together. Each line starts with another timestamp. When splunk indexes the events, it writes all columns prefixed by a timestamp, which I assume is the timestamp from EVENT_TIME. This gets us events in Splunk with following structure: