How to ignore the timestamp or any time value provided in the logs and use current time of the servers forwarding data instead?

[isha_rastogi]

I am indexing a log file which doesn't have a timestamp, but have a few events that have completion time (how much time it took to complete kind of time difference). Splunk is taking this time as timestamp which ultimately is causing wrong timestamp assignment.

Event is something like below:

[check:INFO][abc.sh] abc.sh Total Time: 0:10:47

In Splunk it is shown as

14/12/2016 10:47:00.000 [check:INFO][abc.sh] abc.sh Total Time: 0:10:47

However, this 10:47 is not the timestamp. For a few events, it is working fine, but not for each event.

I've tried putting the props.conf below on the Search head. I also want to break each line as an event, but it is also not working 😞

[mysourcetype]
DATETIME_CONFIG = CURRENT
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
category = Custom
disabled = false
pulldown_type = true
LINE_BREAKER=([\r\n]+)
MAX_TIMESTAMP_LOOKAHEAD = 0

My forwarders are in EST and Splunk server time is GMT.

[somesoni2 · Accepted solution]

The above configuration should be kept in Indexers OR heavy forwarders. Also, it'll fix this for new data only, old historical data would still be wrong.

[isha_rastogi]

Thanks for suggestion. Deployed above configuration in indexers and it worked. 🙂