Hello, I have a timezone issue that I don't understand. I have two set of indexed logs in different indexes, indexed by the same indexer. The sourcetype is the same for both. I don't explicitly modify the timezone anywhere. For the first index the _time shown is the right one (same as the one in the log itself). Server 1 - _time OK For the second index the _time is 1 hour behind since the daylight saving time a few days ago. If I look at the _time field, it has however the right date_hour but it shows something different. Server2 - _time wrong I checked on the servers where the logs are generated but they are running the same (and right) timezone: CET. I am lost about this issue, any suggestions on where I should look? ... View more