Getting Data In

How do you ingest a file with current time?

test4u
Path Finder

I have files with a time field that is of a previous date . I want to ingest these files in Splunk, but the indexed time of that file should be the current time and not the time of the file .

How do I do that?

Tags (2)
0 Karma

n0str0m08
Explorer

Hi @test4u,

You can set it with DATETIME_CONFIG attribute in props.conf file:

[<sourcetype>]
DATETIME_CONFIG=CURRENT
0 Karma

whrg
Motivator

Hello @test4u,

You need to set DATETIME_CONFIG to CURRENT in your props.conf:

[yoursourcetype]
DATETIME_CONFIG = CURRENT
...
...

Doing so will "will set the time of the event to the time that the event was merged from lines, or worded differently, the time it passed through the aggregator processor."

You need to do this on your heavy forwarder / indexer. Remember to restart Splunk after making changes to configuration files.

Get Updates on the Splunk Community!

ATTENTION!! We’re MOVING (not really)

Hey, all! In an effort to keep this Slack workspace secure and also to make our new members' experience easy, ...

Splunk Admins: Build a Smarter Stack with These Must-See .conf25 Sessions

  Whether you're running a complex Splunk deployment or just getting your bearings as a new admin, .conf25 ...

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...