How to set up time zone for data coming from Splunk DB Connect irrespective of user account's time zone?

[uhkc777]

Hi,
I'm ingesting data from database which are in CST time zone. My account is set to EST. But I'm seeing 5 hours time gap between _time and actual timestamp of event.

If i set my account to UTC, then both the time stamps are matching. Can I know the logic behind that?

I'm working with different number of users in different time zones. If _time is changing based on account time zone, my search queries doesn't work in unique manner for all users.

if I changed the time zone for that DB Source in etc/apps/default/props.conf TZ=US/CST. If i set my account to CST then _time and my actual time stamp of event are matching but what about the users who are in different time zones?.

Help me what to do in this scenario.

Thanks,

[maraman_splunk]

By default, dbconnect will think time is in UTC
but dbconnect maps your data to a sourcetype, let's say you asked it to use mysourcetypedb1
then on the server where dbconnect is installed (if you are in distributed config) , you can add in etc/system/local/props.conf (don't modify default files , they are shipped/owned by product or app owner)
[mysourcetypedb1]
TZ=US/CST

(the props could also be move in a custom TA)
Then Splunk knows it is reading a time with timezone US/CST and convert it internally in UTC (there's no user connected at this step, it's when the data getting indexed)

When you login and search for your data , Splunk will show you the time in your local time zone , whatever your set it.
So the local time you see is always correct (it if says 1PM in your local timezone, then yes it was really that time in your timezone when the event occured but another user in it's timezone would see another local time which is still correct.

Hope that's help understand why time can be automagically correct for multiple users at the same time ...