Getting Data In

Sourcetype Assignment

bharathkumarnec
Contributor

Hello All,

I have two servers with hostnames H1 & H2, both have the same log file named "/apps/logs/log.log"

I have set the line breaking based on source file name in my props.conf,

For ex:
[source::///apps/logs/log.log]

But the log.log available in H1 & H2 are with different time zones.

Even though I separate sourcetypes for H1 & H2 in inputs.conf, default source file configuration is applied based on props.conf

How can I overcome this conflict.

In the example I have just quoted two hosts but in our environment we have 100 such servers.

Regards,
BK

0 Karma

sbbadri
Motivator

@bharathkumarnec
you can override/modify the timezone in props.conf like below

[source::/mnt/ca/...]
TZ = US/Easteren

For more information go through below link,

http://docs.splunk.com/Documentation/SplunkCloud/6.6.0/Data/Applytimezoneoffsetstotimestamps

I hope it helps.

0 Karma
Get Updates on the Splunk Community!

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...

From Alert to Resolution: How Splunk Observability Helps SREs Navigate Critical ...

It's 3:17 AM, and your phone buzzes with an urgent alert. Wire transfer processing times have spiked, and ...