topic Re: Set event time as time the file was created in Getting Data In

Set event time as time the file was created

rusty009 — Sat, 18 Nov 2017 16:50:09 GMT

I have a number of csv files which don't have a 'time' field in them. I would like to set the time of all the events within the csv file as the date when the file was created. Is this possible ?

Re: Set event time as time the file was created

MousumiChowdhur — Sat, 18 Nov 2017 17:53:38 GMT

Hi,

Can you try using DATETIME_CONFIG = CURRENT in your props.conf?

Re: Set event time as time the file was created

rusty009 — Sat, 18 Nov 2017 18:54:08 GMT

that sets it to the current time, I want it to set it to the time the file I am indexing was created

Re: Set event time as time the file was created

ddrillic — Sun, 19 Nov 2017 02:09:17 GMT

For the UI you can try base search | eval _time = _indextime.

Re: Set event time as time the file was created

jbrinkman — Fri, 20 Mar 2020 15:53:14 GMT

DATETIME_CONFIG = NONE

https://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf?utm_source=answers&utm_medium=in-answer&utm_term=props.conf&utm_campaign=refdoc

Under the DATETIME_CONFIG setting
* For file-based inputs (monitor, batch) the time chosen is the
modification timestamp on the file being read.