All Apps and Add-ons

How can I override the timezone for Splunk DBX 3.1?

dshpritz
SplunkTrust
SplunkTrust

Getting data from a database with UTC timestamps, and need to override their timezone. Tried using props.conf configurations (ya know, like the rest of Splunk), but that doesn't work. So how do I set the timezone correctly?

0 Karma
1 Solution

dshpritz
SplunkTrust
SplunkTrust

Well, you don't do it with props.conf. DBX 3.x uses HEC to talk to itself, and in that conversation the timezone gets baked in, so that props.conf settings won't matter.

Instead you have to edit the database connection itself (via GUI or db_connections.conf😞

timezone = <time zone identifier>
# optional, default uses JVM time zone
# The identifier could be:
# an offset from UTC/Greenwich, that uses the same offset regardless given date-time e.g. +08:00
# an area where a specific set of rules for finding the offset from UTC/Greenwich apply e.g. Europe/Paris.

So, it has to be set for the whole connection. So if you have a connection that has different tables with timestamps in different timezones, you will have to get creative.

View solution in original post

dshpritz
SplunkTrust
SplunkTrust

Well, you don't do it with props.conf. DBX 3.x uses HEC to talk to itself, and in that conversation the timezone gets baked in, so that props.conf settings won't matter.

Instead you have to edit the database connection itself (via GUI or db_connections.conf😞

timezone = <time zone identifier>
# optional, default uses JVM time zone
# The identifier could be:
# an offset from UTC/Greenwich, that uses the same offset regardless given date-time e.g. +08:00
# an area where a specific set of rules for finding the offset from UTC/Greenwich apply e.g. Europe/Paris.

So, it has to be set for the whole connection. So if you have a connection that has different tables with timestamps in different timezones, you will have to get creative.

Crashfry
Path Finder

@dshpritz What if the database is running in UTC time and I need it to report in live time to me ( instead of writing only when that UTC time hits ), would i change the localTimezoneConversion line item to True to convert to the time listed in the Timezone?.

Example:
Database is running in UTC time ( 4 hours ahead of me )
I have in my config the timezone being Eastern.
If i enable localtimezoneconversation - will it adjust the time to index to eastern instead of UTC?

0 Karma

dshpritz
SplunkTrust
SplunkTrust

I haven't tried that particular setting.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...