Splunk doesn't recognize timestamp properly when importing data from DB

[ArsenyKapralov]

Hi

I'm importing simple events from Oracle table. I don't have specific field with timestamp in database table and while I'm trying to import data I have a GMT time in the timestamp except GMT+4 as my (and server) timezone should be.

I tried to fix this with such code in props.conf in etc/system/local but didn't succeed:

[sourcetype_name]
TZ=Europe/Moscow

How can I fix this and make correct timestamps?

[pmdba]

If your database is on the correct time zone and you haven't figured out any other way to get Splunk to adjust, I'd recommend adding the timestamp to your SQL query, based on sysdate, so that it comes into Splunk with the proper local timezone adjustment:

select to_char(sysdate,'DD-MM-YYYY HH24:MI:SS') "time", ...