https://community.splunk.com/t5/Getting-Data-In/timezone-setting-based-on-forwarder-naming-convention/m-p/494936#M84458 <P>You just do this in props.conf:</P> <PRE><CODE>[host:.{number=character count preceding D, T, or P}D.*] TZ=TZforDevHere [host:.{number=character count preceding D, T, or P}T.*] TZ=TZforTestHere [host:.{number=character count preceding D, T, or P}P.*] TZ=TZforProdHere </CODE></PRE> Mon, 14 Oct 2019 03:12:43 GMT woodcock 2019-10-14T03:12:43Z https://community.splunk.com/t5/Getting-Data-In/timezone-setting-based-on-forwarder-naming-convention/m-p/494935#M84457 <P>I'm sure Splunk'rs have ran across this already, so here's my issue.</P> <P>We have server naming conventions with "D" for DEV, "T" for TEST and "P" for PROD (in the same position of the server name). They reside in different data centers which are in different timezones. How do I set my props.conf to adjust the TZ value based on the naming convention of the host? The log sourcetypes are the same, going to the same index, but I need to adjust the TZ forward/back as these are in different data centers.</P> <P>Is this setting made with REGEX in the inputs.conf of the app? Or is this done in the props.conf? Confused on exactly where/how to do this. </P> <P>Thanks in advance!</P> Thu, 10 Oct 2019 15:18:54 GMT https://community.splunk.com/t5/Getting-Data-In/timezone-setting-based-on-forwarder-naming-convention/m-p/494935#M84457 joesrepsolc 2019-10-10T15:18:54Z https://community.splunk.com/t5/Getting-Data-In/timezone-setting-based-on-forwarder-naming-convention/m-p/494936#M84458 <P>You just do this in props.conf:</P> <PRE><CODE>[host:.{number=character count preceding D, T, or P}D.*] TZ=TZforDevHere [host:.{number=character count preceding D, T, or P}T.*] TZ=TZforTestHere [host:.{number=character count preceding D, T, or P}P.*] TZ=TZforProdHere </CODE></PRE> Mon, 14 Oct 2019 03:12:43 GMT https://community.splunk.com/t5/Getting-Data-In/timezone-setting-based-on-forwarder-naming-convention/m-p/494936#M84458 woodcock 2019-10-14T03:12:43Z