Getting Data In

Setting other TZ in props.conf

gekoner
Communicator

Does anyone have a list of the valid stings for TZ = ?
I would like to set TZ=GMT-0400 but setting that or any other TZ I can find i.e. US/Atlantic does not work.

Tags (1)
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

As @namanjoshi said.

Also, note that "US/Atlantic" is not a known official zoneinfo time zone name, nor an unofficial one. You might mean "US/Eastern" (unofficial, and the same as "America/New_York"), or "Canada/Atlantic" (unofficial, the same as "America/Halifax"), but those two are different from each other. You can also use "GMT-4" but that will not take Daylight Saving Time into account, which may or may not be what you want.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

As @namanjoshi said.

Also, note that "US/Atlantic" is not a known official zoneinfo time zone name, nor an unofficial one. You might mean "US/Eastern" (unofficial, and the same as "America/New_York"), or "Canada/Atlantic" (unofficial, the same as "America/Halifax"), but those two are different from each other. You can also use "GMT-4" but that will not take Daylight Saving Time into account, which may or may not be what you want.

namanjoshi
Explorer

Reading through the documentation on: http://www.splunk.com/base/Documentation/4.1.8/admin/ApplyTimezoneOffsetstotimestamps#zoneinfo_.28TZ...

The list of entries for TZ can be found at: http://en.wikipedia.org/wiki/List_of_zoneinfo_timezones

Remember if the event contains a timezone specifier with the date, then that is used as the timezone of the date.

If you want to override the date specified in the log entry then you will have to do something like the following:

[server-log]
TIME_PREFIX = ####<
TIME_FORMAT = %d/%m/%Y %I:%M:%S %p
MAX_TIMESTAMP_LOOKAHEAD = 28
TZ = Australia/Sydney

Hope that helps

shivarpith
Path Finder

i did the above mentioned suggestion and it worked. The issue im facing is that when i did this, the timezone for all indexes changed but i need this change only on a purticular sourcetype. is that possible?? can any1 suggest me how to proceed??

0 Karma

DEAD_BEEF
Builder

For anyone else looking for this answer. Yes, you can set it for a specific sourcetype in props.conf as:

[sourectype_name]
TZ = America/New_York
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...