From the beginning of daylight savings, every event indexed by 1 hour, got a wrong timestamp, something like "0:00:00 1-1-1970".
It's the second time that I got this problem but I didn't found any answer and solution for this.
Do you know if it's a bug and how to workarround this ?
Thanks you all!
Yes, it is suggested that you configure timestamp extractions and other settings by sourcetype (in props.conf).
No, you need not configure this by host as long as data from all hosts have the same sourcetype (run this to find out:
index=idx sourcetype=your_sourcetype | stats values(host) by sourcetype)
Please paste some sample events and tell us the expected output.