topic Re: Index time - time field setting in Getting Data In

Index time - time field setting

cafissimo — Fri, 22 Oct 2010 20:30:07 GMT

Hello, is it possible to tell Splunk to ignore timestamps that are in a log file and to consider as timestamp the indexing time?

Thanks in advance,

Luca.

ziegfried — Fri, 22 Oct 2010 21:26:23 GMT

Yes. You can tell Splunk not to extract a timestamp by setting DATETIME_CONFIG to CURRENT in your props.conf for your sourcetype:

[your_sourcetype]
DATETIME_CONFIG = CURRENT

mikelanghorst — Thu, 22 Dec 2011 02:44:50 GMT

Thanks ziegfried, was having trouble finding this.