Getting Data In

Multiple time zones in props.conf

JeremyHagan
Communicator

Hi,

If I have multiple matching TZ references in my props.conf on my indexer which one does it use? Is it just the one that comes first?

For the host in question, it's Windows Event logs are in local time and another sourcetype is in UTC. I have a line in the props.conf that sets the TZ for the host to be the host's own time zone and another that set the TZ for the sourcetype to be UTC. It is preferring the HOST entry over the sourcetype entry. I suspect it is just taking the first match. Is that how it works?

Cheers,
Jeremy.

0 Karma
1 Solution

acharlieh
Influencer

If you follow the link to the props.conf spec documentation: http://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf that was generated in your answers post there's a note about this:

**[<spec>] stanza precedence:**

For settings that are specified in multiple categories of matching [<spec>]
stanzas, [host::<host>] settings override [<sourcetype>] settings.
Additionally, [source::<source>] settings override both [host::<host>]
and [<sourcetype>] settings.

View solution in original post

acharlieh
Influencer

If you follow the link to the props.conf spec documentation: http://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf that was generated in your answers post there's a note about this:

**[<spec>] stanza precedence:**

For settings that are specified in multiple categories of matching [<spec>]
stanzas, [host::<host>] settings override [<sourcetype>] settings.
Additionally, [source::<source>] settings override both [host::<host>]
and [<sourcetype>] settings.

JeremyHagan
Communicator

I've just double checked and the entry for the sourcetype is ABOVE the entry for the host. But the timezone is still preferring the host. Here are the entries from the prop.conf

[sps:audit]
MAX_TIMESTAMP_LOOKAHEAD = 20
TZ = UTC
NO_BINARY_CHECK = 1
SHOULD_LINEMERGE = false
pulldown_type = 1
REPORT-sps:audit = sps:audit:report

[host::serv*]
TZ = Australia/ACT
0 Karma
Get Updates on the Splunk Community!

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...

Stay Connected: Your Guide to February Tech Talks, Office Hours, and Webinars!

&#x1f48c;Keep the new year’s momentum going with our February lineup of Community Office Hours, Tech Talks, ...