https://community.splunk.com/t5/Getting-Data-In/How-can-I-manually-set-the-timestamp-at-index-time/m-p/337266#M62283 <P>I have csv files, but I want know if exists way to fill _time field correctly at index time. I could replace every year with day and month but that's not the question why that is before the index time</P> Tue, 17 Apr 2018 08:17:33 GMT jvardev 2018-04-17T08:17:33Z https://community.splunk.com/t5/Getting-Data-In/How-can-I-manually-set-the-timestamp-at-index-time/m-p/337262#M62279 <P>I have events with a field: </P> <PRE><CODE>2015|... 2016|... 2017|... </CODE></PRE> <P>I want to set a timestamp at index time for each event with same day and month:</P> <PRE><CODE>1/2/2015 1/2/2016 1/2/2017 </CODE></PRE> <P>Thanks in advance!</P> Mon, 16 Apr 2018 10:44:08 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-I-manually-set-the-timestamp-at-index-time/m-p/337262#M62279 jvardev 2018-04-16T10:44:08Z https://community.splunk.com/t5/Getting-Data-In/How-can-I-manually-set-the-timestamp-at-index-time/m-p/337263#M62280 <P>is it a pipe delimited data? does it have a header?</P> Mon, 16 Apr 2018 19:07:26 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-I-manually-set-the-timestamp-at-index-time/m-p/337263#M62280 adonio 2018-04-16T19:07:26Z https://community.splunk.com/t5/Getting-Data-In/How-can-I-manually-set-the-timestamp-at-index-time/m-p/337264#M62281 <P>How is this data generated? Would it be possible for you to update the file generator to include the day and month in the file data?</P> Mon, 16 Apr 2018 19:18:54 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-I-manually-set-the-timestamp-at-index-time/m-p/337264#M62281 somesoni2 2018-04-16T19:18:54Z https://community.splunk.com/t5/Getting-Data-In/How-can-I-manually-set-the-timestamp-at-index-time/m-p/337265#M62282 <P>yes, is delimited by pipes and I have the name fields</P> <P>name1|name2|...<BR /> value1|value2|....</P> Tue, 17 Apr 2018 08:10:42 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-I-manually-set-the-timestamp-at-index-time/m-p/337265#M62282 jvardev 2018-04-17T08:10:42Z https://community.splunk.com/t5/Getting-Data-In/How-can-I-manually-set-the-timestamp-at-index-time/m-p/337266#M62283 <P>I have csv files, but I want know if exists way to fill _time field correctly at index time. I could replace every year with day and month but that's not the question why that is before the index time</P> Tue, 17 Apr 2018 08:17:33 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-I-manually-set-the-timestamp-at-index-time/m-p/337266#M62283 jvardev 2018-04-17T08:17:33Z https://community.splunk.com/t5/Getting-Data-In/How-can-I-manually-set-the-timestamp-at-index-time/m-p/337267#M62284 <P>@jvardev,<BR /> as far as i am aware, you can not assign a manual timestamp in indextime when having the year only.<BR /> with that being said, dealing with structured data as yours (and any data in splunk), you can convert the time in search time and apply it however you would like.</P> Tue, 17 Apr 2018 15:28:39 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-I-manually-set-the-timestamp-at-index-time/m-p/337267#M62284 adonio 2018-04-17T15:28:39Z https://community.splunk.com/t5/Getting-Data-In/How-can-I-manually-set-the-timestamp-at-index-time/m-p/337268#M62285 <P>To solve this, I append the timestamp (day and month) with a script before index it.</P> Mon, 29 Oct 2018 19:46:43 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-I-manually-set-the-timestamp-at-index-time/m-p/337268#M62285 jvardev 2018-10-29T19:46:43Z