If multiple hosts, in different time zones, are sending logs to Splunk . In that case how to configure Timezone props.conf for the hosts individually.
I am using in props.conf
But, how to configure if there are two or more hosts in different timezones ?
It can also completely mess with your timestamping if events are subject to network delays or processing delays. You really need to fix the timezone issue and let Splunk figure out your correct timestamp.
Note that using DATETIME_CONFIG = CURRENT sets the event time to the current time, on the indexer, when the event arrives, regardless of the time stamp in the event itself. It can produce confusing results for batch-style inputs.
Ok, I would suspect it relates to the problem I mention in the other answer about the order that Splunk applies transforms. Have you tried using a more definite TZ such as GMT, CST or whatever LA falls into? Also note it will only affect your newly indexed data and that Splunk will then adjust the timestamp you see based on your timezone defined for your user in the account section in manager
I saw the link posted by you.
My logs are of this format :
<134>Jul 5 04:01:27 barracuda "-" TR 10.11.144.25 80 10.11.144.25 49740 "-" "-" GET HTTP 10.11.144.25 HTTP/1.0 200 1335 118 SERVER PROFILED PASSIVE VALID /index.html 10.11.144.25 49740
and i am using
But, I don't know why it's not working.