Hi,
I am having some issues indexing a database.
We are using a database column as a timestamp for events. This "DateTime" column is is UTC time so we added a line in props.conf to specify time format TZ=UTC (we are using CET time).
When we check the events _time field shows us UTC time for that event, so it seems props.conf is not working.
Any idea about this issue?
Best regards
It won't work that way because it's using HEC internally.
Do this instead: http://docs.splunk.com/Documentation/DBX/3.1.3/DeployDBX/Createandmanagedatabaseconnections#Create_a...
It won't work that way because it's using HEC internally.
Do this instead: http://docs.splunk.com/Documentation/DBX/3.1.3/DeployDBX/Createandmanagedatabaseconnections#Create_a...