How to specify a particular timezone for specific sourcetype? I found the below format the other Splunk question. Can I place it in the inputs.conf? Can two same source types have different timezone?
TZ = TZvalueForYourEventTimestamps
TZ attribute goes in the props.conf file in the appropriate sourcetype stanza. A given sourcetype can have only one time zone specifier, but the data itself can specify a time zone as part of the timestamp for each event. IOW, if you set
TZ = EST events can still have '2017-09-01 16:30:00Z' to indicate a UTC timestamp.
If you want to use the same sourcetype, and the time zone is not explicit, how should the computer be able to tell the difference, from the content of the records?
You can have as many
TZ= definitions as you like but ONLY in
inputs.conf). You can even override the default ASCII-ordering precedence (within a particular
spec) using the
priority argument. Beware of
** stanza precedence:** For settings that are specified in multiple categories of matching  stanzas, [host::] settings override  settings. Additionally, [source::] settings override both [host::] and  settings.
So if your
sourcetype setting is not working, a
source setting may be overriding it.
Typically we use
host spec for
TZ= settings, frequently with wildcards and heavy use of
thank you for the reply. I am using the below config on the forwarder but i don't see time being converted to UTC when i run the search. i also restarted the splunkd.
Index i on EDT
forwarder is on EDT
application is writing logs in UTC