https://community.splunk.com/t5/Getting-Data-In/Assigning-Timestamps-based-on-index-time/m-p/114276#M23907 <P>Because there is no Date in your events, splunk will take current date by default. And events contain time, so Splunk will take time from events only by default.</P> <P>Please go ahead with default settings. </P> Tue, 24 Jun 2014 10:36:07 GMT ankireddy007 2014-06-24T10:36:07Z https://community.splunk.com/t5/Getting-Data-In/Assigning-Timestamps-based-on-index-time/m-p/114275#M23906 <P>I have a log file which includes only time values in the timestamp of each event:</P> <BLOCKQUOTE> <P>10:41:11 (lmgrd)<BR /> 10:41:11 (lmgrd) pid 1504<BR /> 10:41:11 (lmgrd) Detecting other license server manager (lmgrd) processes...<BR /> 10:41:11 (lmgrd) Done rereading<BR /> 10:41:11 (lmgrd) FLEXnet Licensing (v11.9.0.0 build 87342 x64_n6) started on s4311cawv (IBM PC) (6/8/2014)<BR /> 10:41:11 (lmgrd) Copyright (c) 1988-2010 Flexera Software, Inc. All Rights Reserved.<BR /> 10:41:11 (lmgrd) US Patents 5,390,297 and 5,671,412.</P> </BLOCKQUOTE> <P>I would like to have Splunk use a combination of the time extracted from the events and the date the event is indexed to derive a _time value. How can I go about doing this?</P> Fri, 20 Jun 2014 21:55:46 GMT https://community.splunk.com/t5/Getting-Data-In/Assigning-Timestamps-based-on-index-time/m-p/114275#M23906 rtadams89 2014-06-20T21:55:46Z https://community.splunk.com/t5/Getting-Data-In/Assigning-Timestamps-based-on-index-time/m-p/114276#M23907 <P>Because there is no Date in your events, splunk will take current date by default. And events contain time, so Splunk will take time from events only by default.</P> <P>Please go ahead with default settings. </P> Tue, 24 Jun 2014 10:36:07 GMT https://community.splunk.com/t5/Getting-Data-In/Assigning-Timestamps-based-on-index-time/m-p/114276#M23907 ankireddy007 2014-06-24T10:36:07Z