The venerable old-skool Splunk forums are now closed. Feel free to search for old content here, but new posts are no longer supported.

Instead, please visit the thriving community at answers.splunk.com to ask and answer questions about your Splunk deployment and how to get the most out of it.

Forums: SplunkAdministration: Setting timezone with the dynamic input header?

Previous Topic: Excluding time in date format  |   Next Topic: splunk-wmi crashes regularly


Posts 1–3 of 3
1
posted by: lalleman  |  posts
date: January 26, 2009
permalink

Is is possible to set timezone information dynamically using the dynamic input header? I have a scripted input that pulls log events from a number of different tables, and some of the timestamps are in UTC and some are in localtime. I'm setting the different properties by using the magical line:
{*SPLUNK* sourcetype=db_input source=db_table host=db_host}

These all seem to be valid settings that you would set in an inputs.conf stanza, so I tried setting the "TZ" value as well, but it doesn't seem to work. (The docs don't go into much detail on what you can and can't set here..)

{*SPLUNK* sourcetype=db_input source=db_table host=db_host TZ=UTC}

Any thoughts?

2
posted by: lalleman  |  posts
date: January 26, 2009
permalink

Doh. Wiki formating! Let's try that again:

***SPLUNK*** sourcetype=db_input source=db_table host=db_host TZ=UTC

3
posted by: lalleman  |  posts
date: January 28, 2009
permalink

I found my answer. The way to do this is by adding an entry in props.conf, like so:

[db_input]
TZ= UTC