Hi David, what do you mean with "do the same searches 2 hours later"? Are you selecting the same time range in the web interface again? Are you simply reloading the already loaded search results? Are there any (caching) proxies or reverse proxies between you and the Graylog web interface? Or maybe even your web browser is caching those pages?
Cheers, Jochen On Friday, 13 May 2016 15:31:37 UTC+2, David Gerdeman wrote: > > I might have found a bug...running graylog 2.0.0 virtual appliance > recently upgraded to 2.0.1. > > On the search tab, using the "relative" search options, if I select > "search in the last 5 minutes" at 7:30Am, and then I select "search in the > last 15 minutes" at 7:45Am, both will return the correct time range of data > the first time they are used as a search parameter. However, if I do the > same searches 2 hours later, it will retrieve the same data (7:25-7:30 and > 7:30-7:45). If I view the JSON query for these searches, the time frame it > uses does not change. I am always able to retrieve the most recent data if > I use a search time frame I have not used yet. > > This behavior is seen in both 2.0.0 and 2.0.1, and appears in both of my > graylog servers. Both machines have almost identical configurations, but > have different workloads. Time/timezone show correctly on both the VM and > the web console. UTC timestamps on the incoming data are being correctly > shifted to CST time zone. This behavior exists in a freshly configured > virtual appliance as well. > > Any help or ideas would be appreciated. > Thanks! > -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to graylog2+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/95327b15-dc77-4e05-826f-c5fdc26d8849%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
