Hi, i am new to splunk so i am having a little bit of problem understanding the timestamp concept. So with the data that i am working the _time column has taken the date and time from event data. But i want the _time column to display date and time when i uploaded that data in splunk for indexing.
So basically if this is the format:
(Time ) Events
(11/13/2019.2:30:20 ) 11-13-2019 14:30:20
So this is how the time is being taken from the event but i want it to change to the date 24th april, 2020 (04/24/2020) on which i uploaded the data .
How can i do this?? Plz help me.