Let's say we have 16 hosts with the same sourcetype=devicetype
14 hosts are in UTC, 2 hosts are in EST (local) time zones.
All hosts have name that starts with the same prefix "host-": host-au, host-uk, host-sg, host-tw, etc
What's the best way to apply TZ = UTC to only 14 hosts and not to 2 that already has timestamp in local ETC format?
Apply it on hosts instead of sourcetype or create two different apps.
[host::$YOUR REGEX$]
[source::] and [host::] stanza match language:
Match expressions must match the entire name, not just a substring. If you
are familiar with regular expressions, match expressions are based on a full
implementation of PCRE with the translation of ..., * and . Thus . matches a
period, * matches non-directory separators, and ... matches any number of
any characters.
For more information see the wildcards section at:
http://docs.splunk.com/Documentation/Splunk/latest/Data/Specifyinputpathswithwildcards
https://docs.splunk.com/Documentation/Splunk/latest/admin/Propsconf
before you do, why the system emits data in local format? can they configure the backend to use UTC or send timezone info also in the log like an rfc3339 standard?
@koshyk, we tried. We don't have access to the vendor's devices. Their support teams claimed that they did what they could on their side by changing system time to UTC format. They also claimed that they cannot change format of syslog logs being sent.
Apply it on hosts instead of sourcetype or create two different apps.
[host::$YOUR REGEX$]
[source::] and [host::] stanza match language:
Match expressions must match the entire name, not just a substring. If you
are familiar with regular expressions, match expressions are based on a full
implementation of PCRE with the translation of ..., * and . Thus . matches a
period, * matches non-directory separators, and ... matches any number of
any characters.
For more information see the wildcards section at:
http://docs.splunk.com/Documentation/Splunk/latest/Data/Specifyinputpathswithwildcards
https://docs.splunk.com/Documentation/Splunk/latest/admin/Propsconf
@valiquet, thank you again for suggestion. That's what I did: used [host::] with regex that would exclude two of the servers we don't need to apply different TZ.
The props.conf allows specification of TZ attribute by host as well, so you can setup stanzas for each host/host prefix (it allows wildcard for hosts) and add appropriate TZ attribute.