Let's say we have 16 hosts with the same sourcetype=devicetype
14 hosts are in UTC, 2 hosts are in EST (local) time zones.
All hosts have name that starts with the same prefix "host-": host-au, host-uk, host-sg, host-tw, etc
What's the best way to apply TZ = UTC to only 14 hosts and not to 2 that already has timestamp in local ETC format?
↧