Getting Data In

How to set the time events were indexed as the event timestamp, not the time the logs were written?

nmaiorana
Explorer

I would like to read log data by the time the log was ingested, not the time the log was written. For example, give me logs ingested by Splunk in the last 30 seconds. This is almost like a real-time ingestion, except I'm not looking at the log entry time.

0 Karma
1 Solution

sundareshr
Legend
0 Karma

nmaiorana
Explorer

I can't get to the link provided.

Thanks

0 Karma

nmaiorana
Explorer

That's it! Thank you.

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...