Getting Data In

Can I have multiple specs (host, source, sourcetype) in props.conf?

helenashton
Path Finder

In props.conf, I see you can have the spec as host, source, sourcetype etc. Can you combine them? Can I have host AND sourcetype (for example)?

0 Karma

wrangler2x
Motivator

For hosts that are not using local time either on the system or in particular applications, I use a heavy forwarder on them and set the time zone in props.conf, which I push out via Deployment Server alone with inputs.conf. Here is one props.conf entry:

[mswin_2008r2_iisw3c-ews]
TZ = GMT
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3NZ
MAX_TIMESTAMP_LOOKAHEAD = 25

This works just fine.

0 Karma

wrangler2x
Motivator

That '5.' appearing above is being added by the save process. I did not put it there. I edited it again and it was not there. Saved it again and it came back. Ignore that.

0 Karma

ppablo
Retired

got rid of the "5." for ya 🙂

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi helenashton,

So, based on the comment you want to set a TZ for a specific host for a certain sourcetype.
This is un-tested so I'm not sure if it will work, but this is what you can try.

props.conf

[YourSourceType]
TRANSFORMS-001_YourSourceType_set_TimeZone = YourSourceType_set_TimeZone

transforms.conf

[YourSourceType_set_TimeZone]
SOURCE_KEY = MetaData:Host
REGEX = MyServerNameToSetTZ
DEST_KEY = MetaData:TZ
FORMAT = UTC 

This will use the transform on YourSourceType and the REGEX should match the hostname. The DEST_KEY sets what will be re-written and the FORMAT will be the new value used in this field.

Hope this makes sense and helps ...

cheers, MuS

MuS
SplunkTrust
SplunkTrust

Short answer: No. But maybe you should explain a bit more about why you want to do so or what your final goal is?

helenashton
Path Finder

We use the same sourcetype for the same log format, but we have some which have not specified the timezone in their logs and so we need to do this in props.conf, but I'd need to be able to specify the host.

I'd like to keep the sourcetype the same as everything else about the structure is the same.

I can't just specify the host, as there are other sourcetypes in that host which I don't want to effect.

Any ideas?

0 Karma

MuS
SplunkTrust
SplunkTrust

Yes 🙂 wait some minutes and you get the answer ....

0 Karma

aganji1
Loves-to-Learn

is there a answer for this, im looking for same solution. 

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...