SPL
date_zone=local is bad
Description
Impact: since there is no timezone, the logs will have the same timezone as the local user. Therefore in another timezone, the logs won't have the same order. If no TZ is specified, perhaps we could hard code one.
0 2
|tstats count where index=* date_zone=local by index, sourcetype
Comments
0 total
Be the first to comment on this SPL.
Leave a comment
You must log in to post a comment.