Set event time as time the file was created

[rusty009]

I have a number of csv files which don't have a 'time' field in them. I would like to set the time of all the events within the csv file as the date when the file was created. Is this possible ?

[jbrinkman]

DATETIME_CONFIG = NONE

https://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf?utm_source=answers&utm_medium=in...

Under the DATETIME_CONFIG setting
* For file-based inputs (monitor, batch) the time chosen is the
modification timestamp on the file being read.

[MousumiChowdhur]

Hi,

Can you try using DATETIME_CONFIG = CURRENT in your props.conf?

[rusty009]

that sets it to the current time, I want it to set it to the time the file I am indexing was created

[ddrillic]

For the UI you can try base search | eval _time = _indextime.