Ok, that makes sense. More than one time-based field in the event can cause confusion 😉 But this creates a problem. You could - since you're saying that only some subset of your events contains the timezone - do a conditional evaluation like | eval mytime=if(like(match(mytime,".*-[A-Z]+$"),strptime(mytime,"format with timezone"),strptime(mytime,"format without timezone") or even, if you can enumerate hosts or sources with/without timezone, you could make a conditon based on that field. But. I'd strongly advise to reconfigure your sources so that they do include the timezone information within the timestamp. Remember that if you're evaluating your search, it's parsing the time according to your user's configured timezone, which might not be a problem if you assume that none of your users will be far enough to warrant a different timezone. But it might mean that daylight saving comes into play. Without a timezone information within the time string you don't know whether it was in "summer time" or "winter time". So you might get different results depending on when you're calling your search and you'll never know which results are proper ones. And you don't even know if the source is reporting the time properly.
... View more
