Prepend all lines forwarded with a timestamp

[Kindred]

Hi,

We have an application log that doesn't contain timestamps, but we'd actually like to have them within the raw event.

Is it possible (either on a Forwarder or at index time) to tell Splunk to prepend a timestamp to all lines it receives?

[woodcock · Accepted solution]

This is not possible with just splunk; you will have to pre-process the events on the forwarder using some other software.

[Kindred]

I thought as such since there are certain cases that would cause odd behaviour. When the forwarder is reading the file in (relatively) real-time and they are getting indexed in a similar amount of time, then the added log timestamp would be useful to understand the order of the events when looking at the logs afterwards (outside of Splunk), but since you may have network issues and delays in forwarding/reading the file - if it indexed the entire file at once they'd all have the same timestamp which isn't that useful.

[richgalloway]

In your props.conf file put DATETIME_CONFIG=CURRENT in the appropriate sourcetype stanza(s).

[Kindred]

This adds a timestamp to the raw event? I thought that was just related to ordering? Will give it a try anyway and see.

[woodcock]

It does NOT add it to the raw event but it causes the _time field to have the value of the time when the event was indexed on the indexer (roughly the time the event was forwarded from the forwarder).