Timestamp mismatch between McAfee EPOEvents and Splunk DB Connect app

Applicability

Splunk Enterprise, Splunk Cloud, Splunk DB Connect

Description

McAfee ePolicy Orchestrator (ePO) uses Microsoft SQL Server database to store much of its data, including the threat events. A basic ePO deployment will have the following 3 databases created:

• ePO_servername
• ePO_servername_Events
• ePO_servername_Mobile

There is one table within the ePO_servername_Events that is of great interest for security analysts: dbo.EPOEvents. This table is where the threat events are stored.

It is a common scenario for Splunk users to fetch the dbo.EPOEvents events using Splunk DB Connect app. To set up the database connection, follow the standard DB Connect procedure for connecting to the Microsoft SQL Server.

Once connection is established, the next step is configuring the inputs via DB Connect's Data Lab UI. Basic input configuration is relatively straight forward thanks to the guided table discovery process. However, this is the confusing part for McAfee dbo.EPOEvents: The fetched events will have UTC timestamp by default and not local Splunk server time.
 

Investigation

As per db_connections.conf.spec, there are 2 timezones related settings in the db_connections.conf that can alter the timestamps behaviour, however the usage is unclear.

timezone = <time zone identifier>   (for example: timezone = Australia/Sydney)
localTimezoneConversionEnabled = [true | false]
 

Resolution

Please note that there are 2 parts of DB Connect where timestamp is relevant:

1. When the event is ingested: Incorrect timezone will result in the events being ingested using the wrong _time.
2. The Data Lab UI: This is where user previews the events before saving the input.

Using the McAfee dbo.EPOEvents as an example (remember that it is using UTC timezone), you can force the events to be ingested using local Splunk server time by setting: 

timezone = GMT

This sounds like a paradox, but to achieve the above, timezone should be set to the the database's timezone, not Splunk server's timezone.

And that will only settle the ingestion, not the Data Lab UI. If you wish to see the events in this UI in local Splunk server timezone, set:

localTimezoneConversionEnabled = true

The db_connections.conf's connection stanza will look something like this:
 

[my_test_connection]
connection_type = generic_mssql
database = master
disabled = 0
host = epodatabaseserver
identity = splunker
jdbcUseSSL = false
port = 1433
readonly = false
localTimezoneConversionEnabled = true
timezone = GMT

Related Links

Splunk Community:
Splunk DB Connect: very little data being indexed
 

Revision History

Revision	Publish Date	Comments
1.0	29-Sep-2026	Initial Release