How to use source file modification time instead o...

Getting Data In

Hello guys,

how to use the source file modification date instead of "guessed" or extracted timestamp from csv file?

I'm using specific sourcetype and extracting fields at search time (fields transformations)

Thanks.

Splunk 7.3.4

* If this helps, please upvote or accept solution if it solved *

Get Updates on the Splunk Community!

You use Splunk every day, come and help shape what's next. Save Your Seat: Product-Focused Sessions at ...

The Problem: Too Many Alerts, Too Little Context Security operations teams running Splunk Enterprise Security ...

Watch Now Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas Do you ever feel ...

How to use source file modification time instead of guessed date in events?