https://community.splunk.com/t5/Getting-Data-In/TimeZone-setting-not-working-for-host-set-from-host-regex/m-p/183445#M36726 <P>Fair enough; my bad.<BR /> Even if I fix that, it still doesn't work.<BR /> I have another stanza like this which also does not work:<BR /> <CODE><BR /> [host::IE*]<BR /> TZ = US/Pacific<BR /> </CODE></P> Fri, 30 May 2014 07:33:17 GMT woodcock 2014-05-30T07:33:17Z https://community.splunk.com/t5/Getting-Data-In/TimeZone-setting-not-working-for-host-set-from-host-regex/m-p/183443#M36724 <P>This configuration is not working:</P> <P>From inputs.conf<BR /> <CODE><BR /> [monitor:///somepath/<EM>.csv]<BR /> host_regex = .</EM><EM>([^</EM>]<EM>)<EM>[^</EM>]</EM>.csv(?:.gz)?$<BR /> sourcetype = somesourcetype<BR /> </CODE></P> <P>From props.conf:<BR /> <CODE><BR /> [host::PR*]<BR /> TZ = US/Atlantic<BR /> </CODE></P> <P>The host is correctly being set but the TZ is not. Based on this (version 6.1, BTW), I am assuming that if the host value is set using "host_regex", then "host" cannot be used to start a stanza in props.conf, right? If not, why does this not work?</P> Fri, 30 May 2014 04:06:05 GMT https://community.splunk.com/t5/Getting-Data-In/TimeZone-setting-not-working-for-host-set-from-host-regex/m-p/183443#M36724 woodcock 2014-05-30T04:06:05Z https://community.splunk.com/t5/Getting-Data-In/TimeZone-setting-not-working-for-host-set-from-host-regex/m-p/183444#M36725 <P>Setting the TZ off of the host that has been set with host_regex is totally legit.</P> <P>However... the Atlantic Standard Time Zone is a Not a US time zone... That's Quebec...</P> <P>Atlantic Standard Time - Quebec - Lower North Shore (Canada) That's -4:00 with no DST</P> <P>I imagine however based on the host example you are using that you're looking for Puerto Rico<BR /> America/Puerto_Rico which is also -4:00/-4:00 with no DST</P> <P><A href="http://en.wikipedia.org/wiki/List_of_tz_database_time_zones">http://en.wikipedia.org/wiki/List_of_tz_database_time_zones</A></P> Fri, 30 May 2014 06:07:08 GMT https://community.splunk.com/t5/Getting-Data-In/TimeZone-setting-not-working-for-host-set-from-host-regex/m-p/183444#M36725 rsennett_splunk 2014-05-30T06:07:08Z https://community.splunk.com/t5/Getting-Data-In/TimeZone-setting-not-working-for-host-set-from-host-regex/m-p/183445#M36726 <P>Fair enough; my bad.<BR /> Even if I fix that, it still doesn't work.<BR /> I have another stanza like this which also does not work:<BR /> <CODE><BR /> [host::IE*]<BR /> TZ = US/Pacific<BR /> </CODE></P> Fri, 30 May 2014 07:33:17 GMT https://community.splunk.com/t5/Getting-Data-In/TimeZone-setting-not-working-for-host-set-from-host-regex/m-p/183445#M36726 woodcock 2014-05-30T07:33:17Z https://community.splunk.com/t5/Getting-Data-In/TimeZone-setting-not-working-for-host-set-from-host-regex/m-p/183446#M36727 <P>OK, I figured it out.</P> <P>This DOES NOT WORK:<BR /> <CODE><BR /> [host::CH...|DA...|NV...]<BR /> TZ = US/Central<BR /> </CODE></P> <P>This DOES WORK:<BR /> <CODE><BR /> [host::(CH...|DA...|NV...)]<BR /> TZ = US/Central<BR /> </CODE></P> Wed, 04 Jun 2014 04:15:26 GMT https://community.splunk.com/t5/Getting-Data-In/TimeZone-setting-not-working-for-host-set-from-host-regex/m-p/183446#M36727 woodcock 2014-06-04T04:15:26Z