How can I manually set the timestamp at index time?

[jvardev]

I have events with a field:

2015|...
2016|...
2017|...

I want to set a timestamp at index time for each event with same day and month:

1/2/2015 
1/2/2016
1/2/2017

Thanks in advance!

[adonio · Accepted solution]

@jvardev,
as far as i am aware, you can not assign a manual timestamp in indextime when having the year only.
with that being said, dealing with structured data as yours (and any data in splunk), you can convert the time in search time and apply it however you would like.

[jvardev]

To solve this, I append the timestamp (day and month) with a script before index it.

[somesoni2]

How is this data generated? Would it be possible for you to update the file generator to include the day and month in the file data?

[jvardev]

I have csv files, but I want know if exists way to fill _time field correctly at index time. I could replace every year with day and month but that's not the question why that is before the index time

[adonio]

is it a pipe delimited data? does it have a header?

[jvardev]

yes, is delimited by pipes and I have the name fields

name1|name2|...
value1|value2|....