Getting Data In

How to change _time to the time when i uploaded the data into splunk???

nikitha15
Explorer

Hi, i am new to splunk so i am having a little bit of problem understanding the timestamp concept. So with the data that i am working the _time column has taken the date and time from event data. But i want the _time column to display date and time when i uploaded that data in splunk for indexing.

So basically if this is the format:
(Time ) Events
(11/13/2019.2:30:20 ) 11-13-2019 14:30:20

So this is how the time is being taken from the event but i want it to change to the date 24th april, 2020 (04/24/2020) on which i uploaded the data .
How can i do this?? Plz help me.

Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @nikitha15,
you have to ingest these logs using a sourcetype with this option:

DATETIME_CONFIG = CURRENT

You can test this option using the guided Add Data web procedure.

Ciao.
Giuseppe

gcusello
SplunkTrust
SplunkTrust

Hi @nikitha15 ,

You accepted this answer during the closing period, so your acceptance wasn'r recorded, could you accept it again?

Ciao.

Giuseppe

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!