https://community.splunk.com/t5/Splunk-Search/Issue-with-date-and-time-for-indexed-csv-data/m-p/390729#M172024 <P>I am facing date time issue while indexing csv data . <BR /> I do have a date field in my CSV file but i want to consider system time for an indexed data. I have added below parameters into props.conf of windows UF and on single instance linux splunk server $splunk home$/etc/system/local props.conf but still it is taking date/ time from the csv file.<BR /> Please suggest.</P> <P>DATETIME_CONFIG = NONE<BR /> MAX_TIMESTAMP_LOOKAHEAD = 0</P> Tue, 29 Sep 2020 23:56:53 GMT darshini2790 2020-09-29T23:56:53Z https://community.splunk.com/t5/Splunk-Search/Issue-with-date-and-time-for-indexed-csv-data/m-p/390729#M172024 <P>I am facing date time issue while indexing csv data . <BR /> I do have a date field in my CSV file but i want to consider system time for an indexed data. I have added below parameters into props.conf of windows UF and on single instance linux splunk server $splunk home$/etc/system/local props.conf but still it is taking date/ time from the csv file.<BR /> Please suggest.</P> <P>DATETIME_CONFIG = NONE<BR /> MAX_TIMESTAMP_LOOKAHEAD = 0</P> Tue, 29 Sep 2020 23:56:53 GMT https://community.splunk.com/t5/Splunk-Search/Issue-with-date-and-time-for-indexed-csv-data/m-p/390729#M172024 darshini2790 2020-09-29T23:56:53Z https://community.splunk.com/t5/Splunk-Search/Issue-with-date-and-time-for-indexed-csv-data/m-p/390730#M172025 <P>@darshini2790 if you are planning to use current time, should you not be using?</P> <PRE><CODE> DATETIME_CONFIG = CURRENT </CODE></PRE> Thu, 04 Apr 2019 13:46:20 GMT https://community.splunk.com/t5/Splunk-Search/Issue-with-date-and-time-for-indexed-csv-data/m-p/390730#M172025 niketn 2019-04-04T13:46:20Z https://community.splunk.com/t5/Splunk-Search/Issue-with-date-and-time-for-indexed-csv-data/m-p/390731#M172026 <P>Yes I have tried that as well and no luck.</P> Fri, 05 Apr 2019 11:06:26 GMT https://community.splunk.com/t5/Splunk-Search/Issue-with-date-and-time-for-indexed-csv-data/m-p/390731#M172026 darshini2790 2019-04-05T11:06:26Z https://community.splunk.com/t5/Splunk-Search/Issue-with-date-and-time-for-indexed-csv-data/m-p/390732#M172027 <P>Hi,</P> <OL> <LI>MAX_TIMESTAMP_LOOKAHEAD should <STRONG>not</STRONG> be set to 0.</LI> <LI>DATETIME_CONFIG should <STRONG>not</STRONG> be set to "none" in your case. </LI> <LI>Did you set <CODE>KV_MODE = none</CODE> on your Search Head? The question is, if you want indexed extractions or not.</LI> </OL> <P>Skalli</P> Wed, 30 Sep 2020 00:02:46 GMT https://community.splunk.com/t5/Splunk-Search/Issue-with-date-and-time-for-indexed-csv-data/m-p/390732#M172027 skalliger 2020-09-30T00:02:46Z