Getting Data In

Why are similar events showing different datetimes?


I'm facing something strange about _time and timezone.

We have 2 hosts indexing the same event type (Unix:Uptime).

On the search head, I have the following situation:

1 - The first host shows the correct timestamp
2 - The second host shows the timestamp 1 hour ago

The events have the same timezone and the same "date_hour" field.

What I'm doing wrong?

alt text

0 Karma

Esteemed Legend

Ignore all the date_* fields unless you desire to ignore your personal Time zone setting and like the time normalized to UTC/GMT (which is what those fields are). Check your Time zone setting and also the _indextime value. I suspect that you are seeing the result of falling back for Daylight Savings.

0 Karma


Daylight savings kicked in over the weekend. Have you validated that the OS properly updated the time on the box where the forwarder is off?



Yes, I have already checked the time in the universal forwarders, heavy forwarders, indexers and search heads.

Here in Brazil the daylight savings should have started the last weekend, but we don´t have it anymore.

Note that the raw events is being indexed with the correct timestamp, but in some cases the search head shows the wrong date.

0 Karma