Timezone configuration with daylight savings time

StefanW — Tue, 13 Apr 2021 05:38:28 GMT

Hello,

since daylight savings time is active we have a time offset for our events.

For example, we use das splunk stream addon to ingest netflow data.

Within the Events, the timestamp is configured "2021-04-13T05:32:31Z". For my understanding with Z for zulu (UTC)

But if i search for events my _time is 07:32:31. two hours later.. Our timezone is Europe/Berlin.

How can i get this fixed? In the sourcetype of stream_netflow is the timestamp configured to auto.

The OS time from the indexer/search head or universal forwarder are correct to CEST and the time is also correct.

We have several other sourcestypes where the time offset is around 1 or 2 hours.

topic Timezone configuration with daylight savings time in Getting Data In