After daylight savings some timestamp errors

[chlima]

Hi everyone!

From the beginning of daylight savings, every event indexed by 1 hour, got a wrong timestamp, something like "0:00:00 1-1-1970".

It's the second time that I got this problem but I didn't found any answer and solution for this.

Do you know if it's a bug and how to workarround this ?

Thanks you all!

[sudosplunk]

@chlima,

Did you explicitly configure timestamp extraction using props.conf? If yes, can you share sample events and your configuration settings(props.conf) for timestamp extraction.

[chlima]

I didn't set it in props.conf.
Since I receive a lot event types (sourcetypes), should I configure it for each host by sourcetype?
There is a way to do it globally?
Thank you.

[sudosplunk]

Yes, it is suggested that you configure timestamp extractions and other settings by sourcetype (in props.conf).
No, you need not configure this by host as long as data from all hosts have the same sourcetype (run this to find out: index=idx sourcetype=your_sourcetype | stats values(host) by sourcetype)
Please paste some sample events and tell us the expected output.

[msivill_splunk]

This answer may provide some pointers for you

https://answers.splunk.com/answers/241990/does-splunk-take-into-consideration-timezone-dayli.html

[chlima]

Hello!
There is a way to do it globally (for all hosts)?
Thank you.

[msivill_splunk]

On the event coming in is there a timezone as part of the timestamp?

[chlima]

Thank you for your answer.

I didn't check out all events, but i can say most does not have TZ.