https://community.splunk.com/t5/Splunk-Search/Change-the-Fschange-indexing-date/m-p/52383#M12720 <P>Is it possible to change the Fschange indexing date, not time?</P> <P>My need is: if a file is added/modified/deleted the date January 17 2012 at 09:30, is it possible to index it the date January 16 2012 at 09:30?</P> <P>Workarond: leaving the indexing real date/time, is it possible add a new field with the indexing date -1 day?</P> <P>Thanks a lot.</P> Tue, 17 Jan 2012 11:55:08 GMT Cris 2012-01-17T11:55:08Z https://community.splunk.com/t5/Splunk-Search/Change-the-Fschange-indexing-date/m-p/52383#M12720 <P>Is it possible to change the Fschange indexing date, not time?</P> <P>My need is: if a file is added/modified/deleted the date January 17 2012 at 09:30, is it possible to index it the date January 16 2012 at 09:30?</P> <P>Workarond: leaving the indexing real date/time, is it possible add a new field with the indexing date -1 day?</P> <P>Thanks a lot.</P> Tue, 17 Jan 2012 11:55:08 GMT https://community.splunk.com/t5/Splunk-Search/Change-the-Fschange-indexing-date/m-p/52383#M12720 Cris 2012-01-17T11:55:08Z https://community.splunk.com/t5/Splunk-Search/Change-the-Fschange-indexing-date/m-p/52384#M12721 <P>I dont think there is a way to alert the date in fschange. The date is taken from the local system time of the indexer.</P> Tue, 17 Jan 2012 14:58:58 GMT https://community.splunk.com/t5/Splunk-Search/Change-the-Fschange-indexing-date/m-p/52384#M12721 hedgehog 2012-01-17T14:58:58Z