Splunk Enterprise

Splunk DB Connect Scheduling: conflict between time zone of scheduled time and actual run time

mlevsh
Builder

We are using Splunk DB Connect version 3.4.0 and schedule Jobs to run on cron.
We are in Easter time zone. 
When the Job is scheduled to run at certain time, it runs an hour later , than expected.

For example: 
At 12:39pm EST the following Job "S_dbconect_test_job"  is scheduled to be run at 12:41pm EST,
but internal log shows that the scheduling is logged at 11:39pm , not at 12:39pm, as result the jobs runs at 1:39pm EST. Here is the entry from internal log:

6/24/21 12:39:50.487 PM
2021-06-24 11:39:50.487 -0500 [dw-679 - PUT /api/inputs/S_dbconect_test_job] INFO org.easybatch.extensions.quartz.JobScheduler - Scheduling job org.easybatch.core.job.BatchJob@1956b4b7 with cron expression 0 41 12 ? * *
host = host03 source = /opt/splunk/var/log/splunk/splunk_app_db_connect_server.log sourcetype = dbx_server


Time zone of connection , used for the Job, is set to  US/Eastern: -04:00
Where does this one hour difference might come from?
Appreciated any advises 


 

Labels (1)
0 Karma
1 Solution

mlevsh
Builder

@phemme 

What  os system are you using and which TZ zone are you in?

We are in EST/EDT zone and we are running DB Connect on Linux.
First we have added the following environmental variable TZ  to splunk user  "/home/<splunk_user>/.bash_profile":
                  TZ = America/New_York
                  export TZ

where TZ value is from here: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones
We just implemented that solution yesterday and still testing. But the initial testing was good. The 1 hr difference was gone. 

Update:
The solution worked until server got rebooted. 

So the second try on solution was to add TZ = America/New_York to 
/opt/splunk/etc/splunk-launch.conf and that worked after Splunk restart and Splunk reboot as well.

View solution in original post

Tags (1)

phemme
Engager

We have exactly the same issue.. Any ideas?

mlevsh
Builder

@phemme 

What  os system are you using and which TZ zone are you in?

We are in EST/EDT zone and we are running DB Connect on Linux.
First we have added the following environmental variable TZ  to splunk user  "/home/<splunk_user>/.bash_profile":
                  TZ = America/New_York
                  export TZ

where TZ value is from here: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones
We just implemented that solution yesterday and still testing. But the initial testing was good. The 1 hr difference was gone. 

Update:
The solution worked until server got rebooted. 

So the second try on solution was to add TZ = America/New_York to 
/opt/splunk/etc/splunk-launch.conf and that worked after Splunk restart and Splunk reboot as well.

Tags (1)
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

SignalFlow: What? Why? How?

What is SignalFlow? Splunk Observability Cloud’s analytics engine, SignalFlow, opens up a world of in-depth ...

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...