Is it possible to use sourcetype and host stanzas for the same event?

[danielbb]

We have the varonis ta and its props has the following section -

[varonis:ta]

However, each varonis server that sends us data has a different time zone and the data doesn't have the time zone as part of it. Therefore, can I have also?

[host::tkvar*]
TZ = <Tokyo Time Zone>

Will it work?

[saravanan90]

Yes it will. The precedence order will be of the below. 

• source
• host
• sourcetype

https://docs.splunk.com/Documentation/Splunk/8.1.0/Admin/Attributeprecedencewithinafile#Precedence_f...

---
An upvote would be appreciated if the above comment is helpful.