Hi,
If I have multiple matching TZ references in my props.conf on my indexer which one does it use? Is it just the one that comes first?
For the host in question, it's Windows Event logs are in local time and another sourcetype is in UTC. I have a line in the props.conf that sets the TZ for the host to be the host's own time zone and another that set the TZ for the sourcetype to be UTC. It is preferring the HOST entry over the sourcetype entry. I suspect it is just taking the first match. Is that how it works?
Cheers,
Jeremy.
↧