Getting Data In

How do you ingest a file with current time?

test4u
Path Finder

I have files with a time field that is of a previous date . I want to ingest these files in Splunk, but the indexed time of that file should be the current time and not the time of the file .

How do I do that?

Tags (2)
0 Karma

n0str0m08
Explorer

Hi @test4u,

You can set it with DATETIME_CONFIG attribute in props.conf file:

[<sourcetype>]
DATETIME_CONFIG=CURRENT
0 Karma

whrg
Motivator

Hello @test4u,

You need to set DATETIME_CONFIG to CURRENT in your props.conf:

[yoursourcetype]
DATETIME_CONFIG = CURRENT
...
...

Doing so will "will set the time of the event to the time that the event was merged from lines, or worded differently, the time it passed through the aggregator processor."

You need to do this on your heavy forwarder / indexer. Remember to restart Splunk after making changes to configuration files.

Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...