Getting Data In

Specifying timezone by host and sourcetype

We have a sourcetype for /var/log/messages that is logged in the local server time on almost every host.

We have one host, however, which logs /var/log/messages (and some other files) in GMT. The system time on this host is set to the local timezone. This host is sending logs via the universal forwarder.

I understand that I need to probably need to modify props.conf on the Splunk host which is indexing the logs. My question is, how do I specify that I only want sourcetype foo from host bar (and ONLY host bar) to be in GMT?

Can I do something like this?
[source::/var/log/messages AND host::bar]


0 Karma


Where do I conf that?
Timestamp is a parse time function and must be done at the indexer. 6.0 helps a bit.

0 Karma


Timestamp is recognized when Splunk parse the event. So, you will need to configure appropriate Timezone setting on your universal forwarder with host, not central indexer. Hope this help.

0 Karma