Archive

How to change the timestamp of duplicate events

sesharao92
Explorer

I tried to change the time stamp of duplicate events. Can any one suggest me a solution.

Tags (1)
0 Karma

lakshman239
SplunkTrust
SplunkTrust

I don't think you can change the timestamp after indexing. Pls try to remove ingesting duplicate event if you can.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.