topic Setting other TZ in props.conf in Getting Data In

Setting other TZ in props.conf

gekoner — Thu, 07 Jul 2011 01:09:50 GMT

Does anyone have a list of the valid stings for TZ = ?
I would like to set TZ=GMT-0400 but setting that or any other TZ I can find i.e. US/Atlantic does not work.

Re: Setting other TZ in props.conf

namanjoshi — Thu, 07 Jul 2011 02:24:18 GMT

Reading through the documentation on: http://www.splunk.com/base/Documentation/4.1.8/admin/ApplyTimezoneOffsetstotimestamps#zoneinfo_.28TZ.29_database

The list of entries for TZ can be found at: http://en.wikipedia.org/wiki/List_of_zoneinfo_timezones

Remember if the event contains a timezone specifier with the date, then that is used as the timezone of the date.

If you want to override the date specified in the log entry then you will have to do something like the following:

[server-log]
TIME_PREFIX = ####<
TIME_FORMAT = %d/%m/%Y %I:%M:%S %p
MAX_TIMESTAMP_LOOKAHEAD = 28
TZ = Australia/Sydney

Hope that helps

Re: Setting other TZ in props.conf

gkanapathy — Thu, 07 Jul 2011 03:40:13 GMT

As @namanjoshi said.

Also, note that "US/Atlantic" is not a known official zoneinfo time zone name, nor an unofficial one. You might mean "US/Eastern" (unofficial, and the same as "America/New_York"), or "Canada/Atlantic" (unofficial, the same as "America/Halifax"), but those two are different from each other. You can also use "GMT-4" but that will not take Daylight Saving Time into account, which may or may not be what you want.

Re: Setting other TZ in props.conf

shivarpith — Thu, 10 Dec 2015 17:40:38 GMT

i did the above mentioned suggestion and it worked. The issue im facing is that when i did this, the timezone for all indexes changed but i need this change only on a purticular sourcetype. is that possible?? can any1 suggest me how to proceed??

Re: Setting other TZ in props.conf

DEAD_BEEF — Tue, 26 Dec 2017 16:25:42 GMT

For anyone else looking for this answer. Yes, you can set it for a specific sourcetype in props.conf as:

[sourectype_name]
TZ = America/New_York