https://community.splunk.com/t5/Getting-Data-In/force-timestamp-to-event-receive-time/m-p/50938#M9772 <P>the solution is to disable the timestamp processor:</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/TuneTimestampExtractionForBetterIndexingPerformance#Disable_timestamp_processor">http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/TuneTimestampExtractionForBetterIndexingPerformance#Disable_timestamp_processor</A></P> <P>"Splunk does not look at the text of the event for the timestamp. Instead, it uses the event's "time of receipt"</P> Tue, 05 Mar 2013 02:45:21 GMT monzy 2013-03-05T02:45:21Z https://community.splunk.com/t5/Getting-Data-In/force-timestamp-to-event-receive-time/m-p/50937#M9771 <P>how can i force the timestamp of an event to be the receive time and ignore all other timestamps in the event.</P> Tue, 05 Mar 2013 02:40:27 GMT https://community.splunk.com/t5/Getting-Data-In/force-timestamp-to-event-receive-time/m-p/50937#M9771 monzy 2013-03-05T02:40:27Z https://community.splunk.com/t5/Getting-Data-In/force-timestamp-to-event-receive-time/m-p/50938#M9772 <P>the solution is to disable the timestamp processor:</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/TuneTimestampExtractionForBetterIndexingPerformance#Disable_timestamp_processor">http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/TuneTimestampExtractionForBetterIndexingPerformance#Disable_timestamp_processor</A></P> <P>"Splunk does not look at the text of the event for the timestamp. Instead, it uses the event's "time of receipt"</P> Tue, 05 Mar 2013 02:45:21 GMT https://community.splunk.com/t5/Getting-Data-In/force-timestamp-to-event-receive-time/m-p/50938#M9772 monzy 2013-03-05T02:45:21Z