1. I also would make sure that you actually have a value for all events for that timestamp. I.e. if your csv includes open tickets do not used closed as timestamp because some event will not have value there. Also, you can use earliest and latest to get a bigger window than the one you are looking for and then use explicit filtering based on the actual date field you want to filter for. 2. There are another two options: a) Even if you are receving events from different TZ they might have agreed in using a standar TZ for all logs, such as GMT. Check that with the owner of the app. b) If you can get separate csv files for each TZ you can apply different TZ when indexing them.
... View more