Sourcetype Assignment

[bharathkumarnec]

Hello All,

I have two servers with hostnames H1 & H2, both have the same log file named "/apps/logs/log.log"

I have set the line breaking based on source file name in my props.conf,

For ex:
[source::///apps/logs/log.log]

But the log.log available in H1 & H2 are with different time zones.

Even though I separate sourcetypes for H1 & H2 in inputs.conf, default source file configuration is applied based on props.conf

How can I overcome this conflict.

In the example I have just quoted two hosts but in our environment we have 100 such servers.

Regards,
BK

[sbbadri]

@bharathkumarnec
you can override/modify the timezone in props.conf like below

[source::/mnt/ca/...]
TZ = US/Easteren

For more information go through below link,

http://docs.splunk.com/Documentation/SplunkCloud/6.6.0/Data/Applytimezoneoffsetstotimestamps

I hope it helps.