Index events with timestamp of previous day

[rajeshjlnt]

We have a report from a system that needs to be indexed into splunk on monthly basis. This report is generated on 1st day of every month. 

Our requirement is to index events in this report on last day of previous month. So i want to index data from this report with timestamp of previous day.

Is this possible?

[rajeshjlnt · Accepted solution]

I added following in props.conf and transforms.conf to get the desired results,

transforms.conf

[timestamp-currenttime-oneday]
INGEST_EVAL = _time=time() - 86400

props.conf

[mysourcetype]
TRANSFORMS-gettime = timestamp-currenttime-oneday

[isoutamo]

Hi

I'm not sure if I understood right your question, but you could get last month events by the next query:

index=_internal earliest=-1mon@mon latest=-0mon@mon
| stats earliest(_time) as eTime latest(_time) as lTime
| eval eTime = strftime(eTime, "%F %T %z"), lTime = strftime(lTime, "%F %T %z")
| table eTime lTime

To show reports day e.g. as last day of previous month just take day part of lTime (I suppose that you have events on it).

r. Ismo

[rajeshjlnt]

Thanks for your response @isoutamo , but my question is to manipulate timestamp during indexing events.

During event indexing there are settings in sourcetype like Auto, Current, Advanced and Configuration file. I would like to know if there is a way to set timestamp to be (current time - 1 day)

[isoutamo]

I haven't try this but there is INGEST_EVAL on transforms.conf (https://docs.splunk.com/Documentation/Splunk/8.1.0/Admin/Transformsconf) which can help you.
r. Ismo

[rajeshjlnt]

thanks @isoutamo for showing right direction