*nix App macro question

[hartfoml]

I was looking in the nix app today and ran the 'Failed_Logins_by_Host(*)' Macro

This macro expands to

remoteSearch litsearch index=os ( ( "failed login" OR "FAILED LOGIN" OR "Authentication failure" OR "Failed to authenticate user" OR "authentication ERROR" OR "Failed password for" ) ) host=* | addinfo type=count label=prereport_events | fields keepcolorder=t "*" "host" "index" "linecount" "prestats_reserved_*" "psrsvd_*" "source" "sourcetype" "splunk_server" | remotetl nb=300 et=1381338000.000000 lt=1381355354.000000 max_count=10000 | prestats count by host

My question is that I don't know what the term "remotetl" is used for in this search.

Anyone know what that term is used for?

[araitz · Accepted solution]

This is part of the literal search that is dispatched to indexers. "remotetl" stands for remote timeline. When you look at this level of detail in the literal search, there is a lot that you will find that has no relevance to using the search language in practice but is important for the underlying search API.