topic Using index time as time stamp in Getting Data In

Using index time as time stamp

carmackd — Tue, 01 Mar 2011 03:06:58 GMT

Is there anyway to ignore the events time stamp, and set it to the current system time (at the event's index time)?

I'm using light weight forwarders so I assume this would need to be done on the indexer.

Re: Using index time as time stamp

carmackd — Tue, 01 Mar 2011 03:12:26 GMT

I was looking through the documentation and found the answer shortly after I posted.

If your events are indexed in real time, increase Splunk's overall indexing performance by turning off timestamp lookahead (set MAX_TIMESTAMP_LOOKAHEAD = 0). This causes Splunk to not look into event's for a timestamp, and sets an event's timestamp to be its indexing time (using current system time).

Re: Using index time as time stamp

dwaddle — Tue, 01 Mar 2011 03:14:37 GMT

You should be able to do this using props.conf on the indexer (since you're using LWF)

[mysourcetype]
DATETIME_CONFIG = CURRENT

See http://www.splunk.com/base/Documentation/latest/Admin/Propsconf for more info.

Re: Using index time as time stamp

carmackd — Mon, 28 Sep 2020 09:25:44 GMT

Thanks, this worked, but MAX_TIMESTAMP_LOOKAHEAD = 0 did not, which confuses me. Why would the documentation say setting the MAX_TIMESTAMP_LOOKAHEAD to 0 will cause splunk not to look into the event for a timestamp, and use the the current system time as the timestamp? I did not see this behavior when I used this configuration.

Re: Using index time as time stamp

dwaddle — Tue, 01 Mar 2011 23:31:36 GMT

Can you post a link to where you found that in the docs? I didn't see it in the reference for props.conf, which confused me a little.

Re: Using index time as time stamp

jrodman — Wed, 02 Mar 2011 05:09:49 GMT

Docs scrubbed. Sorry, old error. Passes smell test but was incorrect.