Getting Data In
×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question

How to use source file modification time instead of guessed date in events?

splunkreal
Motivator
‎09-28-2021 07:36 AM

Hello guys,

how to use the source file modification date instead of "guessed" or extracted timestamp from csv file?

I'm using specific sourcetype and extracting fields at search time (fields transformations)

Thanks.

Splunk 7.3.4

 

* If this helps, please upvote or accept solution if it solved *
0 Karma
Reply
Register for .conf25!
Get Updates on the Splunk Community!

ATTENTION!! We’re MOVING (not really)

Hey, all! In an effort to keep this Slack workspace secure and also to make our new members' experience easy, ...

Splunk Admins: Build a Smarter Stack with These Must-See .conf25 Sessions

  Whether you're running a complex Splunk deployment or just getting your bearings as a new admin, .conf25 ...

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...
Top