Splunk Enterprise

Splunk DB Connect Scheduling: conflict between time zone of scheduled time and actual run time

mlevsh
Builder

We are using Splunk DB Connect version 3.4.0 and schedule Jobs to run on cron.
We are in Easter time zone. 
When the Job is scheduled to run at certain time, it runs an hour later , than expected.

For example: 
At 12:39pm EST the following Job "S_dbconect_test_job"  is scheduled to be run at 12:41pm EST,
but internal log shows that the scheduling is logged at 11:39pm , not at 12:39pm, as result the jobs runs at 1:39pm EST. Here is the entry from internal log:

6/24/21 12:39:50.487 PM
2021-06-24 11:39:50.487 -0500 [dw-679 - PUT /api/inputs/S_dbconect_test_job] INFO org.easybatch.extensions.quartz.JobScheduler - Scheduling job org.easybatch.core.job.BatchJob@1956b4b7 with cron expression 0 41 12 ? * *
host = host03 source = /opt/splunk/var/log/splunk/splunk_app_db_connect_server.log sourcetype = dbx_server


Time zone of connection , used for the Job, is set to  US/Eastern: -04:00
Where does this one hour difference might come from?
Appreciated any advises 


 

Labels (1)
0 Karma
1 Solution

mlevsh
Builder

@phemme 

What  os system are you using and which TZ zone are you in?

We are in EST/EDT zone and we are running DB Connect on Linux.
First we have added the following environmental variable TZ  to splunk user  "/home/<splunk_user>/.bash_profile":
                  TZ = America/New_York
                  export TZ

where TZ value is from here: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones
We just implemented that solution yesterday and still testing. But the initial testing was good. The 1 hr difference was gone. 

Update:
The solution worked until server got rebooted. 

So the second try on solution was to add TZ = America/New_York to 
/opt/splunk/etc/splunk-launch.conf and that worked after Splunk restart and Splunk reboot as well.

View solution in original post

Tags (1)

phemme
Engager

We have exactly the same issue.. Any ideas?

mlevsh
Builder

@phemme 

What  os system are you using and which TZ zone are you in?

We are in EST/EDT zone and we are running DB Connect on Linux.
First we have added the following environmental variable TZ  to splunk user  "/home/<splunk_user>/.bash_profile":
                  TZ = America/New_York
                  export TZ

where TZ value is from here: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones
We just implemented that solution yesterday and still testing. But the initial testing was good. The 1 hr difference was gone. 

Update:
The solution worked until server got rebooted. 

So the second try on solution was to add TZ = America/New_York to 
/opt/splunk/etc/splunk-launch.conf and that worked after Splunk restart and Splunk reboot as well.

Tags (1)
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...

Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass

Hello Splunkers,  We’re excited to kick off a Splunk Dashboard contest! We know that dashboards are a primary ...

May 2026 Splunk Expert Sessions: Security & Observability

Level Up Your Operations: May 2026 Splunk Expert Sessions Whether you are refining your security posture or ...