https://community.splunk.com/t5/Getting-Data-In/Perfmon-CPU-timestamp/m-p/492238#M84143 <P>Hello!</P> <P>I'm trying to change the timestamp (_time) from Perfmon:CPU before index, to use my Splunk Heavy Forwarder date instead of the original event timestamp.</P> <P>The Perfmon:CPU _raw is:</P> <PRE><CODE>05/07/2020 15:46:37.269 -0300 collection=CPU object=Processor counter="% Processor Time" instance=_Total Value=1.887035386881708 </CODE></PRE> <P>My Splunk architecture is: Universal Forwarder -&gt; Heavy Forwarder -&gt; Indexer</P> <P>I have tried the following configurations on my Heavy Forwarder (props.conf):</P> <PRE><CODE>[source::Perfmon...] DATETIME_CONFIG = CURRENT MAX_TIMESTAMP_LOOKAHEAD = 1 [Perfmon:CPU] DATETIME_CONFIG = CURRENT MAX_TIMESTAMP_LOOKAHEAD = 1 [source::Perfmon:CPU] DATETIME_CONFIG = CURRENT MAX_TIMESTAMP_LOOKAHEAD = 1 </CODE></PRE> <P>None of this configurations worked and the _time of Perfmon:CPU events already is the original timestamp (first line of _raw).</P> <P>I also configured a transform to remove the first line of _raw event. Even if the first line is removed, the _time field don't respect DATETIME_CONFIG = CURRENT configuration.</P> <P>Can anyone help me?</P> Wed, 30 Sep 2020 05:19:48 GMT douglasmsouza 2020-09-30T05:19:48Z https://community.splunk.com/t5/Getting-Data-In/Perfmon-CPU-timestamp/m-p/492238#M84143 <P>Hello!</P> <P>I'm trying to change the timestamp (_time) from Perfmon:CPU before index, to use my Splunk Heavy Forwarder date instead of the original event timestamp.</P> <P>The Perfmon:CPU _raw is:</P> <PRE><CODE>05/07/2020 15:46:37.269 -0300 collection=CPU object=Processor counter="% Processor Time" instance=_Total Value=1.887035386881708 </CODE></PRE> <P>My Splunk architecture is: Universal Forwarder -&gt; Heavy Forwarder -&gt; Indexer</P> <P>I have tried the following configurations on my Heavy Forwarder (props.conf):</P> <PRE><CODE>[source::Perfmon...] DATETIME_CONFIG = CURRENT MAX_TIMESTAMP_LOOKAHEAD = 1 [Perfmon:CPU] DATETIME_CONFIG = CURRENT MAX_TIMESTAMP_LOOKAHEAD = 1 [source::Perfmon:CPU] DATETIME_CONFIG = CURRENT MAX_TIMESTAMP_LOOKAHEAD = 1 </CODE></PRE> <P>None of this configurations worked and the _time of Perfmon:CPU events already is the original timestamp (first line of _raw).</P> <P>I also configured a transform to remove the first line of _raw event. Even if the first line is removed, the _time field don't respect DATETIME_CONFIG = CURRENT configuration.</P> <P>Can anyone help me?</P> Wed, 30 Sep 2020 05:19:48 GMT https://community.splunk.com/t5/Getting-Data-In/Perfmon-CPU-timestamp/m-p/492238#M84143 douglasmsouza 2020-09-30T05:19:48Z