Getting Data In
Highlighted

How to apply Time Zone TZ = UTC to only 14 hosts out of 16

Builder

Let's say we have 16 hosts with the same sourcetype=devicetype
14 hosts are in UTC, 2 hosts are in EST (local) time zones.
All hosts have name that starts with the same prefix "host-": host-au, host-uk, host-sg, host-tw, etc

What's the best way to apply TZ = UTC to only 14 hosts and not to 2 that already has timestamp in local ETC format?

0 Karma
Highlighted

Re: How to apply Time Zone TZ = UTC to only 14 hosts out of 16

SplunkTrust
SplunkTrust

The props.conf allows specification of TZ attribute by host as well, so you can setup stanzas for each host/host prefix (it allows wildcard for hosts) and add appropriate TZ attribute.

0 Karma
Highlighted

Re: How to apply Time Zone TZ = UTC to only 14 hosts out of 16

Contributor

Apply it on hosts instead of sourcetype or create two different apps.

[host::$YOUR REGEX$]

[source::] and [host::] stanza match language:

Match expressions must match the entire name, not just a substring. If you
are familiar with regular expressions, match expressions are based on a full
implementation of PCRE with the translation of ..., * and . Thus . matches a
period, * matches non-directory separators, and ... matches any number of
any characters.

For more information see the wildcards section at:
http://docs.splunk.com/Documentation/Splunk/latest/Data/Specifyinputpathswithwildcards

https://docs.splunk.com/Documentation/Splunk/latest/admin/Propsconf

View solution in original post

Highlighted

Re: How to apply Time Zone TZ = UTC to only 14 hosts out of 16

Builder

@valiquet, thank you again for suggestion. That's what I did: used [host::] with regex that would exclude two of the servers we don't need to apply different TZ.

0 Karma
Highlighted

Re: How to apply Time Zone TZ = UTC to only 14 hosts out of 16

Super Champion

before you do, why the system emits data in local format? can they configure the backend to use UTC or send timezone info also in the log like an rfc3339 standard?

Highlighted

Re: How to apply Time Zone TZ = UTC to only 14 hosts out of 16

Builder

@koshyk, we tried. We don't have access to the vendor's devices. Their support teams claimed that they did what they could on their side by changing system time to UTC format. They also claimed that they cannot change format of syslog logs being sent.

0 Karma