TimeZone setting not working for host set from host_regex?

[woodcock]

This configuration is not working:

From inputs.conf

[monitor:///somepath/.csv]
host_regex = .([^])[^].csv(?:.gz)?$
sourcetype = somesourcetype


From props.conf:

[host::PR*]
TZ = US/Atlantic


The host is correctly being set but the TZ is not. Based on this (version 6.1, BTW), I am assuming that if the host value is set using "host_regex", then "host" cannot be used to start a stanza in props.conf, right? If not, why does this not work?

[woodcock · Accepted solution]

OK, I figured it out.

This DOES NOT WORK:

[host::CH...|DA...|NV...]
TZ = US/Central


This DOES WORK:

[host::(CH...|DA...|NV...)]
TZ = US/Central


[woodcock]

Fair enough; my bad.
Even if I fix that, it still doesn't work.
I have another stanza like this which also does not work:

[host::IE*]
TZ = US/Pacific


[rsennett_splunk]

Setting the TZ off of the host that has been set with host_regex is totally legit.

However... the Atlantic Standard Time Zone is a Not a US time zone... That's Quebec...

Atlantic Standard Time - Quebec - Lower North Shore (Canada) That's -4:00 with no DST

I imagine however based on the host example you are using that you're looking for Puerto Rico
America/Puerto_Rico which is also -4:00/-4:00 with no DST

http://en.wikipedia.org/wiki/List_of_tz_database_time_zones