Why are similar events showing different datetimes?

[douglasmsouza]

I'm facing something strange about _time and timezone.

We have 2 hosts indexing the same event type (Unix:Uptime).

On the search head, I have the following situation:

1 - The first host shows the correct timestamp
2 - The second host shows the timestamp 1 hour ago

The events have the same timezone and the same "date_hour" field.

What I'm doing wrong?

[woodcock]

Ignore all the date_* fields unless you desire to ignore your personal Time zone setting and like the time normalized to UTC/GMT (which is what those fields are). Check your Time zone setting and also the _indextime value. I suspect that you are seeing the result of falling back for Daylight Savings.

[codebuilder]

Daylight savings kicked in over the weekend. Have you validated that the OS properly updated the time on the box where the forwarder is off?

[douglasmsouza]

Hi,

Yes, I have already checked the time in the universal forwarders, heavy forwarders, indexers and search heads.

Here in Brazil the daylight savings should have started the last weekend, but we don´t have it anymore.

Note that the raw events is being indexed with the correct timestamp, but in some cases the search head shows the wrong date.