Setting options for host regex not working as expected

[cjosephson]

We have a set of hosts that all begin with the letter 'm' and we want to set DATETIME_CONFIG = CURRENT for them.

If I configure by source, like so, I get the behavior I want (all incoming events relabeled with our local server's TZ):

[source::udp*]
DATETIME_CONFIG = CURRENT

However, if I try to do this based on the hostname instead of the source, it just uses the UTC timestamp the data arrived with.

[host::m*]
DATETIME_CONFIG = CURRENT

I saw this post:
http://answers.splunk.com/answers/138280/timezone-setting-not-working-for-host-set-from-host-regex.h...

So I also tried [host::(m*)], but it had no effect. Why is the host regex setting not behaving as I expect? Even if fully specify a hostname without a wildcard, it won't apply the setting for that host.

[MuS]

Hi cjosephson,

What is your data like that you are forwarding, is it structured? Because in this case you need to pay attention to this fact here http://docs.splunk.com/Documentation/Splunk/6.2.4/Forwarding/Routeandfilterdatad#Caveats_for_routing...

Otherwise follow the adivse given by @martin_mueller :

• The configuration files are deployed the indexers or heavy forwarders - check this wiki http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F
• You must restart all Splunk instances
• There are no configuration errors during restart or by using btool
• It will only be valid for new events

cheers, MuS

[cjosephson]

It is syslog data. The machines send the data straight to our single splunk server (we have no forwarders). Does this count as structured data?

I do realize it would only be valid for new events and that I need to restart. I was using the logger command to generate new events and check the timestamps.

If i use btool, " ./splunk btool check", there is no output, which I assume means success. There are no unusual messages in stdout that appear when I restart splunk either.

[MuS]

run this:

$SPLUNK_HOME/bin/splunk cmd btool props list --debug

and check if your [host::m*] entry appears and it has the correct settings.

[cjosephson]

It appears to. I see the /opt/splunk/etc/system/local/props.conf DATETIME_CONFIG = CURRENT
option.