CSV Import with single timestamp? - Splunk Community

Getting Data In

All,

Is there a way to force the _time field in a CSV import to a single time, as opposed to individual stamps per record?

If you set DATETIME_CONFIG = NONE in props.conf it should default to the file's modification time, giving every event the same timestamp.

Get Updates on the Splunk Community!

Join the Hackathon at .conf26 and build a No-Code AI agent

Join us for the AI Agent Buildathon, an in-person, three-hour hands-on Hackathon where you’ll use Splunk Agent ...

Level Up Your Workflow: Mastering Splunk Cloud Management via Terraform

Tech Talk Recap From Chaos to Control: Scaling Splunk Cloud with Infrastructure as Code Managing apps in ...

Forwarder Topology Guidance: Intermediate HF vs Intermediate UF

Why Universal Forwarders Should Not Be Used as Intermediate Forwarders A practical Splunk forwarding topology ...