Hello All,
I have two servers with hostnames H1 & H2, both have the same log file named "/apps/logs/log.log"
I have set the line breaking based on source file name in my props.conf,
For ex:
[source::///apps/logs/log.log]
But the log.log available in H1 & H2 are with different time zones.
Even though I separate sourcetypes for H1 & H2 in inputs.conf, default source file configuration is applied based on props.conf
How can I overcome this conflict.
In the example I have just quoted two hosts but in our environment we have 100 such servers.
Regards,
BK
@bharathkumarnec
you can override/modify the timezone in props.conf like below
[source::/mnt/ca/...]
TZ = US/Easteren
For more information go through below link,
http://docs.splunk.com/Documentation/SplunkCloud/6.6.0/Data/Applytimezoneoffsetstotimestamps
I hope it helps.