Why does setting a TZ for sourcetype "stash" not take effect?

[lcavaliere_splu]

Issue: If you try to apply a TZ in props to sourcetype "stash" (i.e. the sourcetype of summary-indexed data), this setting will not take effect.

An example use case for this is when need to use the "collect" command to summarise data into summary indexes, and these are of simple non-transforming searches where a subset of the events are output to be summarised (i.e. events which will have the same _time as their original counterparts, and which do not have any TZ since the raw event specifies none, and for which we need to apply the TZ via props like in the original events - and it is this behaviour which we are clarifying).

[lcavaliere_splu]

Solution: Apply the TZ setting in props for the sourcetype "stash_new" instead of "stash"

Also, an enhancement request has been submitted for this so a more elegant way of achieving this may be available in future Splunk versions (ref. SPL-161638)