How to set custom user provided timestamp as the Splunk timestamp while logging to Splunk?

[abhishek_singh]

I have a use case in which our user sends us logs in batches in which each individual logs have their own timestamp(when they would have occurred), which we then log individually to the splunk using serilog.sinks.splunk in .net 6.

What we are trying to do is replace the automatically generated logging time in splunk with the original timestamp that we received from our user.

Is this possible in splunk ? and if so then how.

[woodcock]

Create a props.conf on your indexers to do the Magic8:
https://kinneygroup.com/blog/splunk-magic-8-props-conf/

[richgalloway]

Between reading data from the source and writing it to Splunk using serilog.sinks.splunk, you can do anything you want, including replacing the event timestamp.

Be sure the Splunk sourcetype for the data has settings to properly find and interpret the new timestamp. (Don't use DATETIME_CONFIG = current, for example).

[abhishek_singh]

@richgalloway : My apologies if this is a trivial question i am quite new to splunk. Where is this setting for DATETIME_CONFIG present and how can we edit it. Can we do this on the fly using the  serilog.sinks.splunk.

[richgalloway]

DATETIME_CONFIG is one of many settings available in props.conf files on your indexers and heavy forwarders (if any).  It's unlikely it can be set using serilog.sinks.splunk.

See https://docs.splunk.com/Documentation/Splunk/9.0.4/Admin/Propsconf#:~:text=Timestamp%20extraction%20...