I am using Spunk Enterprise to upload log files and generate a timeline. I am uploading a linux secure.log file. It has a date and time stamp, but is missing the year. Splunk is automatically assigning the year 2018. I want to manually set the year to 2017 for just this one log file - not other files. Is there a way to automatically assign the year 2017, but keep the rest of date on the "Set Sourcetype" screen? Apparently you can edit props.conf, but I don't know if that will affect other files too.
