index future date events as today's date in _time

ayush1906 — Wed, 30 Sep 2020 01:26:11 GMT

I am getting a future timestamped event, but I want to index it as default time of index. i.e. at the time when it got indexed.

Presently I have changed

MAX_DAYS_HENCE = 0

in my props.conf. But I found out that the event having tomorrow's date are getting index with tomorrow's date instead of today's date.

Like today its 23 July, I am looking for any events after today to be indexed for time 23 July. But in my case 24 July is taken as a valid date which should not be the case.

Any other workaround would be appreciated.

The source data is JSON response of API which I am indexing via python script and taking PED field as _time

Re: index future date events as today's date in _time

adonio — Tue, 23 Jul 2019 11:53:04 GMT

in props.conf use:
DATETIME_CONFIG = CURRENT

read here:
https://docs.splunk.com/Documentation/Splunk/7.3.0/Data/Configuretimestamprecognition#Timestamp_validity_attributes_and_their_impact_on_events

topic index future date events as today's date in _time in Getting Data In

index future date events as today's date in _time

Re: index future date events as today's date in _time