topic Re: Use import date/time in Splunk Dev

Use import date/time

dbcase — Mon, 05 Jun 2017 21:53:04 GMT

Hi,

Is there a way to use the import date and time vs. having splunk try to interpret a date in the event? The date in our event is meaningless as far as using it for any data analysis.

Re: Use import date/time

somesoni2 — Mon, 05 Jun 2017 22:02:06 GMT

There is an attribute in props.conf called DATETIME_CONFIG which you can set to value CURRENT and Splunk will treat current time (time of import) as the event timestamp.

[yoursourcetype]
...line breaking configs..
DATETIME_CONFIG = CURRENT

Re: Use import date/time

dbcase — Tue, 06 Jun 2017 16:43:23 GMT

Perfect! Thanks Somesoni2!