Hello Splunkers,
I m currently implementing a connection from multiple GCP Buket to Splunk enterprise.
The Add-on automatically index the datas from those buckets on the _timestamps it get them (So if I have a list of transactions from mars to november 2023, that are forwarded today, they will still be index at the same time.
However, I would like for some of those datas to be indexed using a timefields present in the data, depending on the apps that use them (For example App 1 has a time fields named "Start_date" and app 2 has another one named "end_date")
Unfortunately, i cant think of a way to do it, maybe in the props.conf file, but I'm not sure.
Any advices? Thanks
