There is something wrong (or not obvious from the documentation) with how collect takes timezones.
_time fields should be stored in unixtime, right?
I have a report which does a long search and I use collect to take a _time and I use addtime=t to use that _time in the new field.
The original timestamp is stored as:
2019-07-29 23:16:51.884 INFO ... in _raw (UTC). And its timestamp field is set to 2019-07-29 23:16:51.884 (UTC) and in my browser, the _time is set as 2019-07-29T16:16:51.884-07:00. That's all correct.
When I use collect and use that _time, it gets stored as 2019-07-29 23:16:51.884 in the _raw, 2019-07-29 23:16:51.884 in the timestamp field, but it incorrectly uses 2019-07-29T23:16:51.884-07:00 for _time. I don't know why it's using that timezone when it's passing the _time (which I thought was unixtime, which is always UTC).
Seeing this exact same thing. Somehow my timestamp (_time) has -07:00 on the end of it, and this is not the timezone setting of my laptop, or the dataset (in a different timezone). Very strange indeed. Cannot find any other comments about this other than your post.