Hello, The problem is not from the sources. I have several logs sources (Juniper logs, "authpriv" from Linux servers, Cisco ESA logs, etc.) and all had this 1 hour offset between 10/28 and 10/31 02:00:00. You can see in the joined image two events, one just before 02:00:00 (at 01:59:59) and the second one at 02:00:00. The timestamp for the first event is wrong, the timestamp for the second event is correct. Denis ... View more

Hello, After some other investigations, I noticed that in fact ALL events having  syslog format for date and time had this 1 hour offset. The problem started on 10/28/2021 00:00:00 until 10/30/2021 23:59:59. All events after  10/31/2021 00:00:00 have a correct timestamp, so the problem just disappeared. In France we changed from summer time to winter time on Sun 10/31/2021 at 03:00:00 (at 03:00:00, local time was changed to 02:00:00). I never noticed this problem before, I have been using Splunk since 2014. In my opinion, this looks like a bug in Splunk. I know no algorithm for changing summer time to winter time taking place on tuesday. For the application Splunk_TA_juniper, there was no parameters about time in "default/props.conf". There are no parameter either in system props.conf. I added these parameters in "local/props.conf" of application Splunk_TA_juniper before my previous post : [juniper:junos:firewall] TIME_FORMAT = "%b %e %T" TZ = Europe/Paris This did not change anything.   Denis ... View more