Index _time for DB Connects Events Is Coming in a Different Timezone while the DB Has Another Timezone.

Applicability

Splunk Apps Add ons

Description

Database MySQL is in  America/Chicago timezone as well as the Splunk server, but the table of the input in question is in PST so when the events are getting ingested the _time is being recognized 2 hours earlier PST.

 

Investigation

• Changing the timezone of the connection did not help.
• Props.conf does not affect DB Connect sourcetypes as DB Connect uses HEC to ingest data, customizing the timezone in props.conf will not work.
• Converting the timezone of the table via the SQL query could be one of the solutions too.
  
   

Resolution

The final workaround that fixed the issue was editing the JDBC URL pointing to use the specific timezone we want for the _time of Splunk, that way it will take the proper timezone.

To do so, follow he next steps:
Navigate to  DBX > Configuration > Connections> (your connection) > JDBC URL
Click the "Edit JDBC URL" and append this to the end of your JDBC URL:
 

?useLegacyDatetimeCode=false&serverTimezone=America/Chicago

Custom the timezone, to the timezone you would like to have.

?useLegacyDatetimeCode=false&serverTimezone=<Timezone>

JDBC URL with hostname and port following the timezone workaround.

jdbc:mysql://mysql:3306/test?useLegacyDatetimeCode=false&serverTimezone=America/Chicago

 

Revision History

Revision	Publish Date	Comments
1.0	29-Sep-2026	Initial Release