Splunk Search
Highlighted

How can I set a timezone for a specific sourcetytpe?

Path Finder

How to specify a particular timezone for specific sourcetype? I found the below format the other Splunk question. Can I place it in the inputs.conf? Can two same source types have different timezone?

[yourSourcetype]
TZ = TZvalueForYourEventTimestamps

0 Karma
Highlighted

Re: How can I set a timezone for a specific sourcetytpe?

SplunkTrust
SplunkTrust

The TZ attribute goes in the props.conf file in the appropriate sourcetype stanza. A given sourcetype can have only one time zone specifier, but the data itself can specify a time zone as part of the timestamp for each event. IOW, if you set TZ = EST events can still have '2017-09-01 16:30:00Z' to indicate a UTC timestamp.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

Highlighted

Re: How can I set a timezone for a specific sourcetytpe?

SplunkTrust
SplunkTrust

If you want to use the same sourcetype, and the time zone is not explicit, how should the computer be able to tell the difference, from the content of the records?

0 Karma
Highlighted

Re: How can I set a timezone for a specific sourcetytpe?

Esteemed Legend

You can have as many TZ= definitions as you like but ONLY in props.conf (not inputs.conf). You can even override the default ASCII-ordering precedence (within a particular spec) using the priority argument. Beware of spec precedence:

**[] stanza precedence:**
For settings that are specified in multiple categories of matching [] stanzas, [host::] settings override [] settings.
Additionally, [source::] settings override both [host::] and [] settings.

So if your sourcetype setting is not working, a host or source setting may be overriding it.

Typically we use host spec for TZ= settings, frequently with wildcards and heavy use of priority.

0 Karma
Highlighted

Re: How can I set a timezone for a specific sourcetytpe?

Path Finder

thank you for the reply. I am using the below config on the forwarder but i don't see time being converted to UTC when i run the search. i also restarted the splunkd.

Index i on EDT
forwarder is on EDT
application is writing logs in UTC

[sourcetype::webserver_log]
TZ=UTC

0 Karma
Highlighted

Re: How can I set a timezone for a specific sourcetytpe?

Esteemed Legend

What is your inputs.conf configuration and do your events have a date_zone field?

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.