Index time - time field setting

[cafissimo]

Hello, is it possible to tell Splunk to ignore timestamps that are in a log file and to consider as timestamp the indexing time?

Thanks in advance,

Luca.

[ziegfried · Accepted solution]

Yes. You can tell Splunk not to extract a timestamp by setting DATETIME_CONFIG to CURRENT in your props.conf for your sourcetype:

[your_sourcetype]
DATETIME_CONFIG = CURRENT

[mikelanghorst]

Thanks ziegfried, was having trouble finding this.