Assigning Timestamps based on index time

[rtadams89]

I have a log file which includes only time values in the timestamp of each event:

10:41:11 (lmgrd)
10:41:11 (lmgrd) pid 1504
10:41:11 (lmgrd) Detecting other license server manager (lmgrd) processes...
10:41:11 (lmgrd) Done rereading
10:41:11 (lmgrd) FLEXnet Licensing (v11.9.0.0 build 87342 x64_n6) started on s4311cawv (IBM PC) (6/8/2014)
10:41:11 (lmgrd) Copyright (c) 1988-2010 Flexera Software, Inc. All Rights Reserved.
10:41:11 (lmgrd) US Patents 5,390,297 and 5,671,412.

I would like to have Splunk use a combination of the time extracted from the events and the date the event is indexed to derive a _time value. How can I go about doing this?

[ankireddy007 · Accepted solution]

Because there is no Date in your events, splunk will take current date by default. And events contain time, so Splunk will take time from events only by default.

Please go ahead with default settings.