I have a number of csv files which don't have a 'time' field in them. I would like to set the time of all the events within the csv file as the date when the file was created. Is this possible ?
DATETIME_CONFIG = NONE
https://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf?utm_source=answers&utm_medium=in...
Under the DATETIME_CONFIG setting * For file-based inputs (monitor, batch) the time chosen is the modification timestamp on the file being read.
Hi,
Can you try using DATETIME_CONFIG = CURRENT in your props.conf?
that sets it to the current time, I want it to set it to the time the file I am indexing was created
For the UI you can try base search | eval _time = _indextime.
base search | eval _time = _indextime
