Knowledge Management

Why does setting a TZ for sourcetype "stash" not take effect?

lcavaliere_splu
Splunk Employee
Splunk Employee

Issue: If you try to apply a TZ in props to sourcetype "stash" (i.e. the sourcetype of summary-indexed data), this setting will not take effect.

An example use case for this is when need to use the "collect" command to summarise data into summary indexes, and these are of simple non-transforming searches where a subset of the events are output to be summarised (i.e. events which will have the same _time as their original counterparts, and which do not have any TZ since the raw event specifies none, and for which we need to apply the TZ via props like in the original events - and it is this behaviour which we are clarifying).

0 Karma

lcavaliere_splu
Splunk Employee
Splunk Employee

Solution: Apply the TZ setting in props for the sourcetype "stash_new" instead of "stash"

Also, an enhancement request has been submitted for this so a more elegant way of achieving this may be available in future Splunk versions (ref. SPL-161638)

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...