Getting Data In

How do you ingest a file with current time?

test4u
Path Finder

I have files with a time field that is of a previous date . I want to ingest these files in Splunk, but the indexed time of that file should be the current time and not the time of the file .

How do I do that?

Tags (2)
0 Karma

n0str0m08
Explorer

Hi @test4u,

You can set it with DATETIME_CONFIG attribute in props.conf file:

[<sourcetype>]
DATETIME_CONFIG=CURRENT
0 Karma

whrg
Motivator

Hello @test4u,

You need to set DATETIME_CONFIG to CURRENT in your props.conf:

[yoursourcetype]
DATETIME_CONFIG = CURRENT
...
...

Doing so will "will set the time of the event to the time that the event was merged from lines, or worded differently, the time it passed through the aggregator processor."

You need to do this on your heavy forwarder / indexer. Remember to restart Splunk after making changes to configuration files.

Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...