Thanks, Rich, for the swift reply. I realised that my problem statement was not correct, "convert ... into MET" is misleading. "At input time, honour a given time zone and do not assume local time" would have been slightly better. My problem is that there are different data formats in that input file, some UTC, some local time. Splunk converts all from local time into UTC for storage. Therefore I want Splunk to honour a time zone if present. Otherwise processing them later together and with data from other sources becomes a bit complicated. However, either my tests yesterday were wrong or some plug has been pulled, yet it seems to work as expected now: 2022-11-02T16:32:01+0300 UTC Test -> 02/11/2022 14:32:01.000 2022-11-02T16:32:02-0400 UTC Test -> 02/11/2022 21:32:02.000 2022-11-02T16:32:03-0000 UTC Test -> 02/11/2022 17:32:03.000 2022-11-02T16:32:040100 UTC Test -> 03/11/2022 08:31:41.000 = time of data entry (CET/+0100) 2022-11-02T16:32:05CET Test -> 02/11/2022 16:32:05.000 2022-11-02T16:32:06DUMMY Test -> 03/11/2022 08:51:38.000 = time of data entry (CET/+0100) 2022-11-02T16:32:07GMT Test -> 02/11/2022 17:32:07.000 2022-11-02T16:32:08UTC Test -> 02/11/2022 17:32:08.000 All's well that ends well! Volkmar
... View more