Multiple time zones in props.conf

[JeremyHagan]

Hi,

If I have multiple matching TZ references in my props.conf on my indexer which one does it use? Is it just the one that comes first?

For the host in question, it's Windows Event logs are in local time and another sourcetype is in UTC. I have a line in the props.conf that sets the TZ for the host to be the host's own time zone and another that set the TZ for the sourcetype to be UTC. It is preferring the HOST entry over the sourcetype entry. I suspect it is just taking the first match. Is that how it works?

Cheers,
Jeremy.

[acharlieh · Accepted solution]

If you follow the link to the props.conf spec documentation: http://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf that was generated in your answers post there's a note about this:

**[<spec>] stanza precedence:**

For settings that are specified in multiple categories of matching [<spec>]
stanzas, [host::<host>] settings override [<sourcetype>] settings.
Additionally, [source::<source>] settings override both [host::<host>]
and [<sourcetype>] settings.

[JeremyHagan]

I've just double checked and the entry for the sourcetype is ABOVE the entry for the host. But the timezone is still preferring the host. Here are the entries from the prop.conf

[sps:audit]
MAX_TIMESTAMP_LOOKAHEAD = 20
TZ = UTC
NO_BINARY_CHECK = 1
SHOULD_LINEMERGE = false
pulldown_type = 1
REPORT-sps:audit = sps:audit:report

[host::serv*]
TZ = Australia/ACT