Getting Data In

Setting other TZ in props.conf

gekoner
Communicator

Does anyone have a list of the valid stings for TZ = ?
I would like to set TZ=GMT-0400 but setting that or any other TZ I can find i.e. US/Atlantic does not work.

Tags (1)
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

As @namanjoshi said.

Also, note that "US/Atlantic" is not a known official zoneinfo time zone name, nor an unofficial one. You might mean "US/Eastern" (unofficial, and the same as "America/New_York"), or "Canada/Atlantic" (unofficial, the same as "America/Halifax"), but those two are different from each other. You can also use "GMT-4" but that will not take Daylight Saving Time into account, which may or may not be what you want.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

As @namanjoshi said.

Also, note that "US/Atlantic" is not a known official zoneinfo time zone name, nor an unofficial one. You might mean "US/Eastern" (unofficial, and the same as "America/New_York"), or "Canada/Atlantic" (unofficial, the same as "America/Halifax"), but those two are different from each other. You can also use "GMT-4" but that will not take Daylight Saving Time into account, which may or may not be what you want.

namanjoshi
Explorer

Reading through the documentation on: http://www.splunk.com/base/Documentation/4.1.8/admin/ApplyTimezoneOffsetstotimestamps#zoneinfo_.28TZ...

The list of entries for TZ can be found at: http://en.wikipedia.org/wiki/List_of_zoneinfo_timezones

Remember if the event contains a timezone specifier with the date, then that is used as the timezone of the date.

If you want to override the date specified in the log entry then you will have to do something like the following:

[server-log]
TIME_PREFIX = ####<
TIME_FORMAT = %d/%m/%Y %I:%M:%S %p
MAX_TIMESTAMP_LOOKAHEAD = 28
TZ = Australia/Sydney

Hope that helps

shivarpith
Path Finder

i did the above mentioned suggestion and it worked. The issue im facing is that when i did this, the timezone for all indexes changed but i need this change only on a purticular sourcetype. is that possible?? can any1 suggest me how to proceed??

0 Karma

DEAD_BEEF
Builder

For anyone else looking for this answer. Yes, you can set it for a specific sourcetype in props.conf as:

[sourectype_name]
TZ = America/New_York
0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...