I have a number of csv files which don't have a 'time' field in them. I would like to set the time of all the events within the csv file as the date when the file was created. Is this possible ?
DATETIME_CONFIG = NONE
Under the DATETIME_CONFIG setting
* For file-based inputs (monitor, batch) the time chosen is the
modification timestamp on the file being read.
Hi,
Can you try using DATETIME_CONFIG = CURRENT in your props.conf?
that sets it to the current time, I want it to set it to the time the file I am indexing was created
For the UI you can try base search | eval _time = _indextime
.