Timezone issue in Splunk

[shashankk]

Hi Team,

Need your assistance for the configuration changes in Splunk. The requirement is to change the Timezone based on different “source” (not sourcetype).

We have different sources defined in our application. All of them are in their respective server timezone, except for the below 2 sources (these 2 are in EST timezone & our requirement is to change it into CET timezone)

source=/applications/testscan/*/testscn01/*
source=/applications/testscan/*/testcpdom/*

For rest of the other sources, I do not want make any change in the Timezone.

For example:

source=/applications/testscan/*/testscn02/*
source=/applications/testscan/*/testnycus/*
source=/applications/testscan/*/testnyus2/*
source=/applications/testscan/*/testshape/*
source=/applications/testscan/*/testshape2/*
source=/applications/testscan/*/testshape3/*

Please note, we do not have any "props.conf" file available or configured in the server. 

We are maintaining splunk configuration in only "inputs.conf" file. The present content of "inputs.conf" as below:

[monitor:///applications/testscan/.../]
whitelist = (?:tools\/test\/log\/|TODAY\/LOGS\/)*\.(?:log|txt)$
index = testscan_prod
sourcetype = testscan
_TCP_ROUTING = in_prod

[monitor:///applications/testscan/*/*/tools/test_transfer/log]
index = testscan_prod
sourcetype = testscan
_TCP_ROUTING = in_prod

[monitor:///applications/testscan/*/*/tools/test_reports/log]
index = testscan_prod
sourcetype = testscan
_TCP_ROUTING = in_prod

 
Please suggest what changes to be done so that Timezone can be managed based on the "source" information provided.

@ITWhisperer 

[inventsekar]

Please note, we do not have any "props.conf" file available or configured in the server. 

We are maintaining splunk configuration in only "inputs.conf" file. 

Hi @shashankk .. more details pls.. 

is it a dev/test environment or prod.. 

do you have Deployment server or not.. 

any reasons for not having a props.conf and only having inputs.onf

that inputs.conf is on HF or indexer?... you use UF's or some applications send the logs to the monitored folders directly..

[richgalloway]

Building on what @inventsekar said, it is strongly recommended that every sourcetype have a props.conf stanza.  Splunk can guess about how to interpret your data, but using explicit instructions via props.conf is more performant.  If you need to override default behavior, such as specifying a different time zone, props.conf is required.