topic Re: Why are similar events showing different datetimes? in Getting Data In

Why are similar events showing different datetimes?

douglasmsouza — Mon, 04 Nov 2019 16:44:08 GMT

I'm facing something strange about _time and timezone.

We have 2 hosts indexing the same event type (Unix:Uptime).

On the search head, I have the following situation:

1 - The first host shows the correct timestamp
2 - The second host shows the timestamp 1 hour ago

The events have the same timezone and the same "date_hour" field.

What I'm doing wrong?

Re: Why are similar events showing different datetimes?

codebuilder — Mon, 04 Nov 2019 17:48:19 GMT

Daylight savings kicked in over the weekend. Have you validated that the OS properly updated the time on the box where the forwarder is off?

Re: Why are similar events showing different datetimes?

douglasmsouza — Mon, 04 Nov 2019 18:30:24 GMT

Hi,

Yes, I have already checked the time in the universal forwarders, heavy forwarders, indexers and search heads.

Here in Brazil the daylight savings should have started the last weekend, but we don´t have it anymore.

Note that the raw events is being indexed with the correct timestamp, but in some cases the search head shows the wrong date.

Re: Why are similar events showing different datetimes?

woodcock — Mon, 04 Nov 2019 18:57:45 GMT

Ignore all the date_* fields unless you desire to ignore your personal Time zone setting and like the time normalized to UTC/GMT (which is what those fields are). Check your Time zone setting and also the _indextime value. I suspect that you are seeing the result of falling back for Daylight Savings.