Getting Data In

Index time - time field setting

Communicator

Hello, is it possible to tell Splunk to ignore timestamps that are in a log file and to consider as timestamp the indexing time?

Thanks in advance,

Luca.

1 Solution

Influencer

Yes. You can tell Splunk not to extract a timestamp by setting DATETIME_CONFIG to CURRENT in your props.conf for your sourcetype:

[your_sourcetype]
DATETIME_CONFIG = CURRENT

View solution in original post

Influencer

Yes. You can tell Splunk not to extract a timestamp by setting DATETIME_CONFIG to CURRENT in your props.conf for your sourcetype:

[your_sourcetype]
DATETIME_CONFIG = CURRENT

View solution in original post

Motivator

Thanks ziegfried, was having trouble finding this.

0 Karma