Getting Data In

Multiple time zones in props.conf

JeremyHagan
Communicator

Hi,

If I have multiple matching TZ references in my props.conf on my indexer which one does it use? Is it just the one that comes first?

For the host in question, it's Windows Event logs are in local time and another sourcetype is in UTC. I have a line in the props.conf that sets the TZ for the host to be the host's own time zone and another that set the TZ for the sourcetype to be UTC. It is preferring the HOST entry over the sourcetype entry. I suspect it is just taking the first match. Is that how it works?

Cheers,
Jeremy.

0 Karma
1 Solution

acharlieh
Influencer

If you follow the link to the props.conf spec documentation: http://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf that was generated in your answers post there's a note about this:

**[<spec>] stanza precedence:**

For settings that are specified in multiple categories of matching [<spec>]
stanzas, [host::<host>] settings override [<sourcetype>] settings.
Additionally, [source::<source>] settings override both [host::<host>]
and [<sourcetype>] settings.

View solution in original post

acharlieh
Influencer

If you follow the link to the props.conf spec documentation: http://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf that was generated in your answers post there's a note about this:

**[<spec>] stanza precedence:**

For settings that are specified in multiple categories of matching [<spec>]
stanzas, [host::<host>] settings override [<sourcetype>] settings.
Additionally, [source::<source>] settings override both [host::<host>]
and [<sourcetype>] settings.

View solution in original post

JeremyHagan
Communicator

I've just double checked and the entry for the sourcetype is ABOVE the entry for the host. But the timezone is still preferring the host. Here are the entries from the prop.conf

[sps:audit]
MAX_TIMESTAMP_LOOKAHEAD = 20
TZ = UTC
NO_BINARY_CHECK = 1
SHOULD_LINEMERGE = false
pulldown_type = 1
REPORT-sps:audit = sps:audit:report

[host::serv*]
TZ = Australia/ACT
0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!