Why aren't timestamps being recognized consistently?

[gregbo]

I'm index some HL7 v2 files, and sometimes Splunk recognizes the time zone in the timestamp one way, and other times another way. The message types are exactly the same, the source files are the same (just two different times). The field the timestamp is coming from has the values " 20180525054500000-0700" and "20180525073507000-0700"... in Splunk, date_zone for the first shows "-420" and for the second shows "0". The first one is interpreted correctly, but the second one is interpreted as UTC, so the event time is wrong. Both files just have the one event in them.

[FrankVl]

%Y%m%d%H%M%S%z doesn't match the timestamps you have.

%Y: 2018
%m: 05
%d: 25
%H: 05
%M: 45
%S: 00
???: 000 <-- you forgot to match that bit, which I guess is milliseconds?
%z:-0700

I think something like this comes closer: %Y%m%d%H%M%S%3N%z

[FrankVl]

Have you tried specifying the timestamp extraction settings explicitely, rather than letting Splunk guess?

[gregbo]

I believe so, I've got TIME_FORMAT set to %Y%m%d%H%M%S%z, and I've got the TIME_PREFIX and MAX_TIMESTAMP_LOOKAHEAD set as well. I check the MAX_LOOKAHEAD, and it's set to capture all of the timestamp.