topic Re: How to change _time to the time when i uploaded the data into splunk??? in Getting Data In

How to change _time to the time when i uploaded the data into splunk???

nikitha15 — Thu, 28 May 2020 15:26:25 GMT

Hi, i am new to splunk so i am having a little bit of problem understanding the timestamp concept. So with the data that i am working the _time column has taken the date and time from event data. But i want the _time column to display date and time when i uploaded that data in splunk for indexing.

So basically if this is the format:
(Time ) Events
(11/13/2019.2:30:20 ) 11-13-2019 14:30:20

So this is how the time is being taken from the event but i want it to change to the date 24th april, 2020 (04/24/2020) on which i uploaded the data .
How can i do this?? Plz help me.

Re: How to change _time to the time when i uploaded the data into splunk???

gcusello — Thu, 28 May 2020 15:32:40 GMT

Hi @nikitha15,
you have to ingest these logs using a sourcetype with this option:

DATETIME_CONFIG = CURRENT

You can test this option using the guided Add Data web procedure.

Ciao.
Giuseppe

Re: How to change _time to the time when i uploaded the data into splunk???

gcusello — Tue, 16 Jun 2020 12:17:14 GMT

Hi @nikitha15 ,

You accepted this answer during the closing period, so your acceptance wasn'r recorded, could you accept it again?

Ciao.

Giuseppe