Hi, i am new to splunk so i am having a little bit of problem understanding the timestamp concept. So with the data that i am working the _time column has taken the date and time from event data. But i want the _time column to display date and time when i uploaded that data in splunk for indexing.
So basically if this is the format:
(Time ) Events
(11/13/2019.2:30:20 ) 11-13-2019 14:30:20
So this is how the time is being taken from the event but i want it to change to the date 24th april, 2020 (04/24/2020) on which i uploaded the data .
How can i do this?? Plz help me.
Hi @nikitha15,
you have to ingest these logs using a sourcetype with this option:
DATETIME_CONFIG = CURRENT
You can test this option using the guided Add Data web procedure.
Ciao.
Giuseppe
Hi @nikitha15 ,
You accepted this answer during the closing period, so your acceptance wasn'r recorded, could you accept it again?
Ciao.
Giuseppe