Splunk DB Connect - Timestamp for Events Are in the Future

Applicability

Splunk Apps Add ons

Description

The events come from Microsoft SQL server using db connect. The timestamp in the database table is in GMT. When the data is indexed, user preference is set to EST and a search is performed using Show Last 24 hours, data is not returned because the data time stamp is in the future by 6 hours.

 

Investigation

This transformation of the timestamp usually occurs at index time.  Need to check where the data was originating to see how many hops it took to get the data into Splunk.

Also take into consideration what the Splunk documentation says:

"When you add or edit users using Splunk authentication, you can set a user time zone. Search results for that user will appear in the specified time zone. This setting, however, does not change the actual event data, whose time zone is determined at index time."

 

Resolution

To change the timezone for the database:

Go to Configuration → Databases → Connections → "your connection" → in the Timezone drop-down, choose the appropriate time zone.

In addition, review the following Splunk Answers post:
https://answers.splunk.com/answers/512913/splunk-db-connect-how-to-set-correct-timezone-for.html

Related Links

Splunk Answers:

Splunk DB Connect: How to set correct timezone for Splunk DB Connect feeds?
https://answers.splunk.com/answers/512913/splunk-db-connect-how-to-set-correct-timezone-for.html

Splunk Documentation:

Set the time zone for a user's search results
https://docs.splunk.com/Documentation/Splunk/7.3.1/Data/Applytimezoneoffsetstotimestamps#Set_the_time_zone_for_a_user.27s_search_results
 

Revision History

Revision	Publish Date	Comments
1.0	28-Sep-2026	Initial Release