Ad slot: top

SPL

date_zone=local is bad

Description

Submitted by masdeeper

Impact: since there is no timezone, the logs will have the same timezone as the local user. Therefore in another timezone, the logs won't have the same order. If no TZ is specified, perhaps we could hard code one.
0 2
|tstats count where index=* date_zone=local by index, sourcetype

Comments

0 total

Be the first to comment on this SPL.

Leave a comment

You must log in to post a comment.

Ad slot: bottom