Splunk Search

Setting options for host regex not working as expected

cjosephson
Engager

We have a set of hosts that all begin with the letter 'm' and we want to set DATETIME_CONFIG = CURRENT for them.

If I configure by source, like so, I get the behavior I want (all incoming events relabeled with our local server's TZ):

[source::udp*]
DATETIME_CONFIG = CURRENT

However, if I try to do this based on the hostname instead of the source, it just uses the UTC timestamp the data arrived with.

[host::m*]
DATETIME_CONFIG = CURRENT

I saw this post:
http://answers.splunk.com/answers/138280/timezone-setting-not-working-for-host-set-from-host-regex.h...

So I also tried [host::(m*)], but it had no effect. Why is the host regex setting not behaving as I expect? Even if fully specify a hostname without a wildcard, it won't apply the setting for that host.

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi cjosephson,

What is your data like that you are forwarding, is it structured? Because in this case you need to pay attention to this fact here http://docs.splunk.com/Documentation/Splunk/6.2.4/Forwarding/Routeandfilterdatad#Caveats_for_routing...

Otherwise follow the adivse given by @martin_mueller :

cheers, MuS

0 Karma

cjosephson
Engager

It is syslog data. The machines send the data straight to our single splunk server (we have no forwarders). Does this count as structured data?

I do realize it would only be valid for new events and that I need to restart. I was using the logger command to generate new events and check the timestamps.

If i use btool, " ./splunk btool check", there is no output, which I assume means success. There are no unusual messages in stdout that appear when I restart splunk either.

0 Karma

MuS
SplunkTrust
SplunkTrust

run this:

$SPLUNK_HOME/bin/splunk cmd btool props list --debug

and check if your [host::m*] entry appears and it has the correct settings.

0 Karma

cjosephson
Engager

It appears to. I see the /opt/splunk/etc/system/local/props.conf DATETIME_CONFIG = CURRENT
option.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...