Solved: Re: Index time - time field setting - Splunk Community

Getting Data In

Hello, is it possible to tell Splunk to ignore timestamps that are in a log file and to consider as timestamp the indexing time?

Thanks in advance,

Luca.

1 Solution

Solution

Yes. You can tell Splunk not to extract a timestamp by setting DATETIME_CONFIG to CURRENT in your props.conf for your sourcetype:

[your_sourcetype]
DATETIME_CONFIG = CURRENT

View solution in original post

Solution

Yes. You can tell Splunk not to extract a timestamp by setting DATETIME_CONFIG to CURRENT in your props.conf for your sourcetype:

[your_sourcetype]
DATETIME_CONFIG = CURRENT

Thanks ziegfried, was having trouble finding this.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Reuse: Word-play

This puzzle series (first published here) is based on analysing words.Some of the statements in your puzzle ...

Tuning Edge Processor in Hybrid Mode: What Limits Each Data Path

When you run Edge Processor in hybrid mode, alongside a Splunk heavy forwarder on the same host, two questions ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...