We have a set of hosts that all begin with the letter 'm' and we want to set DATETIME_CONFIG = CURRENT for them. If I configure by source, like so, I get the behavior I want (all incoming events relabeled with our local server's TZ): [source::udp*] DATETIME_CONFIG = CURRENT However, if I try to do this based on the hostname instead of the source, it just uses the UTC timestamp the data arrived with. [host::m*] DATETIME_CONFIG = CURRENT I saw this post: http://answers.splunk.com/answers/138280/timezone-setting-not-working-for-host-set-from-host-regex.html?utm_source=typeahead&utm_medium=newquestion&utm_campaign=no_votes_sort_relev So I also tried [host::(m*)] , but it had no effect. Why is the host regex setting not behaving as I expect? Even if fully specify a hostname without a wildcard, it won't apply the setting for that host. ... View more