Getting Data In

Sourcetype Assignment


Hello All,

I have two servers with hostnames H1 & H2, both have the same log file named "/apps/logs/log.log"

I have set the line breaking based on source file name in my props.conf,

For ex:

But the log.log available in H1 & H2 are with different time zones.

Even though I separate sourcetypes for H1 & H2 in inputs.conf, default source file configuration is applied based on props.conf

How can I overcome this conflict.

In the example I have just quoted two hosts but in our environment we have 100 such servers.


0 Karma


you can override/modify the timezone in props.conf like below

TZ = US/Easteren

For more information go through below link,

I hope it helps.

0 Karma