Hi guys, we have a problem when we try to use timecharts that involve dates having in between a daylight saving time change.
If I change my timezone to GMT in account preferences, the timecharts query works fine, but if I do a span=1d it shows September 6 twice and doesn't show September 7.
If i change my timezone to GMT-4 Santiago, the query fails showing NaN numbers.
The query is
: sourcetype=varnish
account_id="50aa2711a6884125020019f1"
| timechart span=1d
distinct_count(customer_id)
All our logs has time fields on UTC.
any ideas?
Thanks!.
You might be running into this problem:
There's something magic about September 6, based on the comments in that thread.