(addendum. this is lame. new users can only use two images, so I’m combining three images into one below…hope that doesn’t confuse)
So using this as a go-by image:
Is this a bug?
(image 1) So browser is set to UTC (this is one of the confusing parts. imo, browser should always be localtime or the timezone of whatever the logs are stored in IE UTC in this case)
The DT stamps I put in are in US PST (which is different than my local time. I’m using this example because I’m attempting to answer someone’s in my organization question. That person is in US PST. My current localtime is US MST)
(image 2) The browser switched DT entries from PST to UTC. Cool enough.
(image 3 et al) search results…this is where part of the confusion lies:
3a is a big part of where my question lies but let’s come back to that.
3b is the log entry at the time of “syslog” storage. In my mind, this is the canonical time entry I guess, but I would have expected 3a and 3b to always be the same regardless of the TZ selected in the browser. This doesn’t seem to be the case. 3a will change dynamically if I switch the browser TZ to something else after the search fact.
3c matches 3b. Cool.
3d (which shows as UTC) switches dynamically with 3a but where is 23:03 coming from? I input a DTS in US PST (09:03-09:06) and then the browser correctly updated it to UTC which became 16:03-16:06, but now 3a and 3d are 23:03 and 23:06? That’s just not making sense to me even if my localtime is US MST. Something seems wrong.
So I mentioned that I’m trying to answer a question about loki posed to me by someone in my organization. That person’s question is apropos with respect to what I’m asking. Succinctly put, what DTS is Loki using to search on? My inquisitor is stating that returns from search results are showing results outside the search window. I can’t answer his question until I understand what Loki is using as a search field.
TIA all. Hopefully this question makes sense. Trying to articulate time questions is complicated.