https://community.splunk.com/t5/Getting-Data-In/configuring-timestamp/m-p/100120#M20931 <P>This is possible, but the timestamp will be the index time at the indexer (not the read time at the forwarder).<BR /> You have to <STRONG>define a sourcetype</STRONG> for your log, and define it in props.conf on the indexer</P> <P><CODE><BR /> [mysourcetypefornotimestamp]<BR /> DATETIME_CONFIG = CURRENT<BR /> </CODE></P> <P>see <A href="http://docs.splunk.com/Documentation/Splunk/5.0.1/Data/Configuretimestamprecognition">http://docs.splunk.com/Documentation/Splunk/5.0.1/Data/Configuretimestamprecognition</A></P> Fri, 25 Jan 2013 16:13:41 GMT yannK 2013-01-25T16:13:41Z https://community.splunk.com/t5/Getting-Data-In/configuring-timestamp/m-p/100119#M20930 <P>Hi,</P> <P>I have a number of logfiles that do not have timestamps. I am processing these logs with the univeral forwarder, on Windows servers. i want the timestamp to be equal to the time of the universal forwarders time when the entry was processed. How would I configure props.conf to do such a thing? </P> Fri, 25 Jan 2013 16:01:00 GMT https://community.splunk.com/t5/Getting-Data-In/configuring-timestamp/m-p/100119#M20930 a212830 2013-01-25T16:01:00Z https://community.splunk.com/t5/Getting-Data-In/configuring-timestamp/m-p/100120#M20931 <P>This is possible, but the timestamp will be the index time at the indexer (not the read time at the forwarder).<BR /> You have to <STRONG>define a sourcetype</STRONG> for your log, and define it in props.conf on the indexer</P> <P><CODE><BR /> [mysourcetypefornotimestamp]<BR /> DATETIME_CONFIG = CURRENT<BR /> </CODE></P> <P>see <A href="http://docs.splunk.com/Documentation/Splunk/5.0.1/Data/Configuretimestamprecognition">http://docs.splunk.com/Documentation/Splunk/5.0.1/Data/Configuretimestamprecognition</A></P> Fri, 25 Jan 2013 16:13:41 GMT https://community.splunk.com/t5/Getting-Data-In/configuring-timestamp/m-p/100120#M20931 yannK 2013-01-25T16:13:41Z