How to specify a particular timezone for specific sourcetype? I found the below format the other Splunk question. Can I place it in the inputs.conf? Can two same source types have different timezone?
[yourSourcetype]
TZ = TZvalueForYourEventTimestamps
The TZ
attribute goes in the props.conf file in the appropriate sourcetype stanza. A given sourcetype can have only one time zone specifier, but the data itself can specify a time zone as part of the timestamp for each event. IOW, if you set TZ = EST
events can still have '2017-09-01 16:30:00Z' to indicate a UTC timestamp.
You can have as many TZ=
definitions as you like but ONLY in props.conf
(not inputs.conf
). You can even override the default ASCII-ordering precedence (within a particular spec
) using the priority
argument. Beware of spec
precedence:
**[] stanza precedence:**
For settings that are specified in multiple categories of matching [] stanzas, [host::] settings override [] settings.
Additionally, [source::] settings override both [host::] and [] settings.
So if your sourcetype
setting is not working, a host
or source
setting may be overriding it.
Typically we use host
spec for TZ=
settings, frequently with wildcards and heavy use of priority
.
thank you for the reply. I am using the below config on the forwarder but i don't see time being converted to UTC when i run the search. i also restarted the splunkd.
Index i on EDT
forwarder is on EDT
application is writing logs in UTC
[sourcetype::webserver_log]
TZ=UTC
What is your inputs.conf
configuration and do your events have a date_zone
field?
If you want to use the same sourcetype, and the time zone is not explicit, how should the computer be able to tell the difference, from the content of the records?
The TZ
attribute goes in the props.conf file in the appropriate sourcetype stanza. A given sourcetype can have only one time zone specifier, but the data itself can specify a time zone as part of the timestamp for each event. IOW, if you set TZ = EST
events can still have '2017-09-01 16:30:00Z' to indicate a UTC timestamp.