Can I have multiple specs (host, source, sourcetype) in props.conf?

[helenashton]

In props.conf, I see you can have the spec as host, source, sourcetype etc. Can you combine them? Can I have host AND sourcetype (for example)?

[wrangler2x]

For hosts that are not using local time either on the system or in particular applications, I use a heavy forwarder on them and set the time zone in props.conf, which I push out via Deployment Server alone with inputs.conf. Here is one props.conf entry:

[mswin_2008r2_iisw3c-ews]
TZ = GMT
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3NZ
MAX_TIMESTAMP_LOOKAHEAD = 25

This works just fine.

[wrangler2x]

That '5.' appearing above is being added by the save process. I did not put it there. I edited it again and it was not there. Saved it again and it came back. Ignore that.

[ppablo]

got rid of the "5." for ya 🙂

[MuS]

Hi helenashton,

So, based on the comment you want to set a TZ for a specific host for a certain sourcetype.
This is un-tested so I'm not sure if it will work, but this is what you can try.

props.conf

[YourSourceType]
TRANSFORMS-001_YourSourceType_set_TimeZone = YourSourceType_set_TimeZone

transforms.conf

[YourSourceType_set_TimeZone]
SOURCE_KEY = MetaData:Host
REGEX = MyServerNameToSetTZ
DEST_KEY = MetaData:TZ
FORMAT = UTC 

This will use the transform on YourSourceType and the REGEX should match the hostname. The DEST_KEY sets what will be re-written and the FORMAT will be the new value used in this field.

Hope this makes sense and helps ...

cheers, MuS

[MuS]

Short answer: No. But maybe you should explain a bit more about why you want to do so or what your final goal is?

[helenashton]

We use the same sourcetype for the same log format, but we have some which have not specified the timezone in their logs and so we need to do this in props.conf, but I'd need to be able to specify the host.

I'd like to keep the sourcetype the same as everything else about the structure is the same.

I can't just specify the host, as there are other sourcetypes in that host which I don't want to effect.

Any ideas?

[MuS]

Yes 🙂 wait some minutes and you get the answer ....

[aganji1]

is there a answer for this, im looking for same solution.