Getting Data In

Is it possible to use sourcetype and host stanzas for the same event?

danielbb
Motivator

We have the varonis ta and its props has the following section -

 

[varonis:ta]

 

However, each varonis server that sends us data has a different time zone and the data doesn't have the time zone as part of it. Therefore, can I have also?

 

[host::tkvar*]
TZ = <Tokyo Time Zone>

 

Will it work?

Labels (1)
0 Karma

saravanan90
Contributor

Yes it will. The precedence order will be of the below. 

  • source
  • host
  • sourcetype

https://docs.splunk.com/Documentation/Splunk/8.1.0/Admin/Attributeprecedencewithinafile#Precedence_f...

---
An upvote would be appreciated if the above comment is helpful.

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!