How can I set a timezone for a specific sourcetytpe?

[kteng2024]

How to specify a particular timezone for specific sourcetype? I found the below format the other Splunk question. Can I place it in the inputs.conf? Can two same source types have different timezone?

[yourSourcetype]
TZ = TZvalueForYourEventTimestamps

[woodcock]

You can have as many TZ= definitions as you like but ONLY in props.conf (not inputs.conf). You can even override the default ASCII-ordering precedence (within a particular spec) using the priority argument. Beware of spec precedence:

**[] stanza precedence:**
For settings that are specified in multiple categories of matching [] stanzas, [host::] settings override [] settings.
Additionally, [source::] settings override both [host::] and [] settings.

So if your sourcetype setting is not working, a host or source setting may be overriding it.

Typically we use host spec for TZ= settings, frequently with wildcards and heavy use of priority.

[kteng2024]

thank you for the reply. I am using the below config on the forwarder but i don't see time being converted to UTC when i run the search. i also restarted the splunkd.

Index i on EDT
forwarder is on EDT
application is writing logs in UTC

[sourcetype::webserver_log]
TZ=UTC

[woodcock]

What is your inputs.conf configuration and do your events have a date_zone field?

[DalJeanis]

If you want to use the same sourcetype, and the time zone is not explicit, how should the computer be able to tell the difference, from the content of the records?

[richgalloway · Accepted solution]

The TZ attribute goes in the props.conf file in the appropriate sourcetype stanza. A given sourcetype can have only one time zone specifier, but the data itself can specify a time zone as part of the timestamp for each event. IOW, if you set TZ = EST events can still have '2017-09-01 16:30:00Z' to indicate a UTC timestamp.