Getting Data In

Sourcetype Assignment

bharathkumarnec
Contributor

Hello All,

I have two servers with hostnames H1 & H2, both have the same log file named "/apps/logs/log.log"

I have set the line breaking based on source file name in my props.conf,

For ex:
[source::///apps/logs/log.log]

But the log.log available in H1 & H2 are with different time zones.

Even though I separate sourcetypes for H1 & H2 in inputs.conf, default source file configuration is applied based on props.conf

How can I overcome this conflict.

In the example I have just quoted two hosts but in our environment we have 100 such servers.

Regards,
BK

0 Karma

sbbadri
Motivator

@bharathkumarnec
you can override/modify the timezone in props.conf like below

[source::/mnt/ca/...]
TZ = US/Easteren

For more information go through below link,

http://docs.splunk.com/Documentation/SplunkCloud/6.6.0/Data/Applytimezoneoffsetstotimestamps

I hope it helps.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...