topic How can I set a timezone for a specific sourcetytpe? in Splunk Search

How can I set a timezone for a specific sourcetytpe?

kteng2024 — Fri, 01 Sep 2017 19:48:52 GMT

How to specify a particular timezone for specific sourcetype? I found the below format the other Splunk question. Can I place it in the inputs.conf? Can two same source types have different timezone?

[yourSourcetype]
TZ = TZvalueForYourEventTimestamps

Re: How can I set a timezone for a specific sourcetytpe?

richgalloway — Fri, 01 Sep 2017 20:31:04 GMT

The TZ attribute goes in the props.conf file in the appropriate sourcetype stanza. A given sourcetype can have only one time zone specifier, but the data itself can specify a time zone as part of the timestamp for each event. IOW, if you set TZ = EST events can still have '2017-09-01 16:30:00Z' to indicate a UTC timestamp.

Re: How can I set a timezone for a specific sourcetytpe?

DalJeanis — Fri, 01 Sep 2017 20:32:21 GMT

If you want to use the same sourcetype, and the time zone is not explicit, how should the computer be able to tell the difference, from the content of the records?

Re: How can I set a timezone for a specific sourcetytpe?

woodcock — Sat, 02 Sep 2017 15:50:52 GMT

You can have as many TZ= definitions as you like but ONLY in props.conf (not inputs.conf). You can even override the default ASCII-ordering precedence (within a particular spec) using the priority argument. Beware of spec precedence:

**[] stanza precedence:**
For settings that are specified in multiple categories of matching [] stanzas, [host::] settings override [] settings.
Additionally, [source::] settings override both [host::] and [] settings.

So if your sourcetype setting is not working, a host or source setting may be overriding it.

Typically we use host spec for TZ= settings, frequently with wildcards and heavy use of priority.

Re: How can I set a timezone for a specific sourcetytpe?

kteng2024 — Tue, 05 Sep 2017 20:24:08 GMT

thank you for the reply. I am using the below config on the forwarder but i don't see time being converted to UTC when i run the search. i also restarted the splunkd.

Index i on EDT
forwarder is on EDT
application is writing logs in UTC

[sourcetype::webserver_log]
TZ=UTC

Re: How can I set a timezone for a specific sourcetytpe?

woodcock — Thu, 07 Sep 2017 02:32:34 GMT

What is your inputs.conf configuration and do your events have a date_zone field?