Getting Data In

Applying timezone on basis of sourcetype and hostname

pranitprakash
Explorer

Hello,
I have requirement for applying time-zone on incoming data on basis of source type and host location both.
I know that we can put the timezone TZ on basis of the source type as follow:
[source::mysource]
TZ=US/Pacific

and also on basis of hostname as follow:
[host::DC1*]
TZ=US/Pacific

However, is it possible to combine these two parameters and put together as below in props.conf:

[source::mysource]
[host::USDC*]
TZ=US/Pacific
[host::AUSDC*]
TZ=Australia/Sydney

so that data of same source type and different sources can get time-zone correctly.

Please advise.

Tags (2)
0 Karma

micahkemp
Champion

No, this is not something you can do.

0 Karma

ddrillic
Ultra Champion

Not much about nesting when googling - splunk nest stanza

0 Karma
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...