I'm facing something strange about _time and timezone.
We have 2 hosts indexing the same event type (Unix:Uptime).
On the search head, I have the following situation:
1 - The first host shows the correct timestamp
2 - The second host shows the timestamp 1 hour ago
The events have the same timezone and the same "date_hour" field.
What I'm doing wrong?
Ignore all the
date_* fields unless you desire to ignore your personal
Time zone setting and like the time normalized to UTC/GMT (which is what those fields are). Check your
Time zone setting and also the
_indextime value. I suspect that you are seeing the result of
falling back for
Yes, I have already checked the time in the universal forwarders, heavy forwarders, indexers and search heads.
Here in Brazil the daylight savings should have started the last weekend, but we don´t have it anymore.
Note that the raw events is being indexed with the correct timestamp, but in some cases the search head shows the wrong date.