Setting other TZ in props.conf

[gekoner]

Does anyone have a list of the valid stings for TZ = ?
I would like to set TZ=GMT-0400 but setting that or any other TZ I can find i.e. US/Atlantic does not work.

[gkanapathy · Accepted solution]

As @namanjoshi said.

Also, note that "US/Atlantic" is not a known official zoneinfo time zone name, nor an unofficial one. You might mean "US/Eastern" (unofficial, and the same as "America/New_York"), or "Canada/Atlantic" (unofficial, the same as "America/Halifax"), but those two are different from each other. You can also use "GMT-4" but that will not take Daylight Saving Time into account, which may or may not be what you want.

[namanjoshi]

Reading through the documentation on: http://www.splunk.com/base/Documentation/4.1.8/admin/ApplyTimezoneOffsetstotimestamps#zoneinfo_.28TZ...

The list of entries for TZ can be found at: http://en.wikipedia.org/wiki/List_of_zoneinfo_timezones

Remember if the event contains a timezone specifier with the date, then that is used as the timezone of the date.

If you want to override the date specified in the log entry then you will have to do something like the following:

[server-log]
TIME_PREFIX = ####<
TIME_FORMAT = %d/%m/%Y %I:%M:%S %p
MAX_TIMESTAMP_LOOKAHEAD = 28
TZ = Australia/Sydney

Hope that helps

[shivarpith]

i did the above mentioned suggestion and it worked. The issue im facing is that when i did this, the timezone for all indexes changed but i need this change only on a purticular sourcetype. is that possible?? can any1 suggest me how to proceed??

[DEAD_BEEF]

For anyone else looking for this answer. Yes, you can set it for a specific sourcetype in props.conf as:

[sourectype_name]
TZ = America/New_York