Sourcetype Assignment

bharathkumarnec — Wed, 26 Jul 2017 11:44:15 GMT

Hello All,

I have two servers with hostnames H1 & H2, both have the same log file named "/apps/logs/log.log"

I have set the line breaking based on source file name in my props.conf,

For ex:
[source::///apps/logs/log.log]

But the log.log available in H1 & H2 are with different time zones.

Even though I separate sourcetypes for H1 & H2 in inputs.conf, default source file configuration is applied based on props.conf

How can I overcome this conflict.

In the example I have just quoted two hosts but in our environment we have 100 such servers.

Regards,
BK

Re: Sourcetype Assignment

sbbadri — Wed, 26 Jul 2017 19:15:22 GMT

@bharathkumarnec
you can override/modify the timezone in props.conf like below

[source::/mnt/ca/...]
TZ = US/Easteren

For more information go through below link,

I hope it helps.