Getting Data In

How to set time zone of logs by source?

ehowardl3
Path Finder

I’m trying to specify that logs from a certain source coming from a UF are UTC. This should be pretty straightforward, however the following props.conf on the indexers does not work.

[source::c:\\path\\to\\logs\\*]
TZ = Etc/UTC

I’ve tried a .* at the end of the file path and many other variations, nothing works as it should according to the props.conf.spec.

Any ideas?

Thanks

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...