Hello,
I am trying to set _time from a given stanza that occurs after the sourcetype stanza is forced. I am using a generic or catch-all sourcetype stanza initially to receive data from the HTTP event collector and then force the events to their appropriate sourcetype from transforms. This sourcetype forcing works perfectly and assigns to the correct source type 2, 3, 4 below, as expected.
Now, I want to be able to set the _time to the value that comes from the time_prefix that is defined within each forced stanza, but this is not working. The _time is always being set to any time_prefix in the first stanza ( sourcetype_1 ), or if I don't specify a time_prefix in the first stanza, Splunk will still assign a _time based on the default time rules.
Is there any way to have the _time set within each forced sourcetype stanza, or will it only be able to work form the first stanza at index time? I could probably create my own datetime.xml, but I was hoping to use the forcing of the sourcetype and have the _time value set within each forced sourcetype stanza. Below is an example:
[sourcetype_1 catch all]
Do not assign _time here
Force sourcetypes 2-4 and have _time assigned in those stanza's
[sourcetype_2]
Want _time set here based on time_prefix.
[sourcetype_3]
Want _time set here based on time_prefix.
[sourcetype_4]
Want _time set here based on time_prefix
