I am able to modify the TZ attribute as follows in $SPLUNKHOME$/etc/system/local/props.conf
[source::mysource]
TZ=US/Pacific
However, I am unable to replicate the same functionality via the host attribute. 192.168.1.1 is a dummy address, but is in the same format as what I'm trying to accomplish.
[host::192.168.1.1]
TZ=US/Pacific
[I noticed there seems to have been in issue with this in the past?][1] I am on version 6.5.0.
[1]: https://answers.splunk.com/answers/31258/tz-offset-in-props-conf-not-working.html+
↧