https://community.splunk.com/t5/Getting-Data-In/Set-timestamp-to-system-or-executiontime-for-scripted-input/m-p/48596#M9220 <P>You can tell Splunk to use the current indexing time as timestamp for the event like this:</P> <PRE><CODE>DATETIME_CONFIG = CURRENT </CODE></PRE> <P>See <A href="http://docs.splunk.com/Documentation/Splunk/5.0.2/admin/Propsconf">http://docs.splunk.com/Documentation/Splunk/5.0.2/admin/Propsconf</A> for reference.</P> Wed, 29 May 2013 10:34:30 GMT martin_mueller 2013-05-29T10:34:30Z https://community.splunk.com/t5/Getting-Data-In/Set-timestamp-to-system-or-executiontime-for-scripted-input/m-p/48595#M9219 <P>Hi</P> <P>I use a script which gets a lot of data back, sometimes the string looks like a timestamp and splunk decide to use this string as a time. This results in a strange behaviour that events become a time which is years ago or in the future.</P> <P>Is it possible to tell splunk, to use the execution or actual system time for this scripted input?</P> <P>One possibility is to create a timestamp in the script, but the output is very long so i would leave unnecessary data.</P> <P>Thanks<BR /> Robert</P> Wed, 29 May 2013 09:22:05 GMT https://community.splunk.com/t5/Getting-Data-In/Set-timestamp-to-system-or-executiontime-for-scripted-input/m-p/48595#M9219 RobertRi 2013-05-29T09:22:05Z https://community.splunk.com/t5/Getting-Data-In/Set-timestamp-to-system-or-executiontime-for-scripted-input/m-p/48596#M9220 <P>You can tell Splunk to use the current indexing time as timestamp for the event like this:</P> <PRE><CODE>DATETIME_CONFIG = CURRENT </CODE></PRE> <P>See <A href="http://docs.splunk.com/Documentation/Splunk/5.0.2/admin/Propsconf">http://docs.splunk.com/Documentation/Splunk/5.0.2/admin/Propsconf</A> for reference.</P> Wed, 29 May 2013 10:34:30 GMT https://community.splunk.com/t5/Getting-Data-In/Set-timestamp-to-system-or-executiontime-for-scripted-input/m-p/48596#M9220 martin_mueller 2013-05-29T10:34:30Z