Is there a question or are you just reporting this? If it is a question, you should provide more information about what you have tried, and what the actual errors are.
Basically, this is a question , able to see events till 4:00 am and after that not able to see.
With the below query able to check the last events :-
| tstats count where index=cat by host, index, source, sourcetype, _time
| search host=* |sort _time
>>>Basically, this is a question , able to see events till 4:00 am and after that not able to see.
Hi @Praz_123 ... you were able to see logs/events till 4am and then not able to see, (for the host with ip 161.209.202.108... next time please avoid the ip addresses in your post, for security concerns)
maybe... there are not events/logs after 4am at all.
so, you should check the team or person who creates those events/logs(at the required host)
Iif you are looking for more details, Pls update us with more info, thanks.
Basically, still not a question. If it is a question, what sort of answer are you expecting?