If multiple hosts, in different time zones, are sending logs to Splunk . In that case how to configure Timezone props.conf for the hosts individually.

[ranjyotiprakash]

If multiple hosts, in different time zones, are sending logs to Splunk . In that case how to configure Timezone props.conf for the hosts individually.

I am using in props.conf

[source::tcp:514]
TZ=America/Los_Angeles

But, how to configure if there are two or more hosts in different timezones ?

Thanks..

[Drainy · Accepted solution]

Have a look at this question just below yours;
http://splunk-base.splunk.com/answers/52227/multiple-timezones-search-worldwide

It covers how to configure the TZ on a per host basis.

[Drainy]

It can also completely mess with your timestamping if events are subject to network delays or processing delays. You really need to fix the timezone issue and let Splunk figure out your correct timestamp.

[sowings]

Note that using DATETIME_CONFIG = CURRENT sets the event time to the current time, on the indexer, when the event arrives, regardless of the time stamp in the event itself. It can produce confusing results for batch-style inputs.

[ranjyotiprakash]

I have used
[source::tcp*]
DATETIME_CONFIG = CURRENT
in props.conf.
works fine with any timezone. Is this correct to use ?

[Drainy]

Ok, I would suspect it relates to the problem I mention in the other answer about the order that Splunk applies transforms. Have you tried using a more definite TZ such as GMT, CST or whatever LA falls into? Also note it will only affect your newly indexed data and that Splunk will then adjust the timestamp you see based on your timezone defined for your user in the account section in manager

[ranjyotiprakash]

Hi Drainy,

I saw the link posted by you.
My logs are of this format :

<134>Jul 5 04:01:27 barracuda "-" TR 10.11.144.25 80 10.11.144.25 49740 "-" "-" GET HTTP 10.11.144.25 HTTP/1.0 200 1335 118 SERVER PROFILED PASSIVE VALID /index.html 10.11.144.25 49740

and i am using
[host::barracuda]
TZ=America/Los_Angeles

But, I don't know why it's not working.