Getting Data In

Applying timezone on basis of sourcetype and hostname

pranitprakash
Explorer

Hello,
I have requirement for applying time-zone on incoming data on basis of source type and host location both.
I know that we can put the timezone TZ on basis of the source type as follow:
[source::mysource]
TZ=US/Pacific

and also on basis of hostname as follow:
[host::DC1*]
TZ=US/Pacific

However, is it possible to combine these two parameters and put together as below in props.conf:

[source::mysource]
[host::USDC*]
TZ=US/Pacific
[host::AUSDC*]
TZ=Australia/Sydney

so that data of same source type and different sources can get time-zone correctly.

Please advise.

Tags (2)
0 Karma

micahkemp
Champion

No, this is not something you can do.

0 Karma

ddrillic
Ultra Champion

Not much about nesting when googling - splunk nest stanza

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...