Getting Data In

Using index time as time stamp

carmackd
Communicator

Is there anyway to ignore the events time stamp, and set it to the current system time (at the event's index time)?

I'm using light weight forwarders so I assume this would need to be done on the indexer.

Tags (2)
1 Solution

dwaddle
SplunkTrust
SplunkTrust

You should be able to do this using props.conf on the indexer (since you're using LWF)

[mysourcetype]
DATETIME_CONFIG = CURRENT

See http://www.splunk.com/base/Documentation/latest/Admin/Propsconf for more info.

View solution in original post

dwaddle
SplunkTrust
SplunkTrust

You should be able to do this using props.conf on the indexer (since you're using LWF)

[mysourcetype]
DATETIME_CONFIG = CURRENT

See http://www.splunk.com/base/Documentation/latest/Admin/Propsconf for more info.

jrodman
Splunk Employee
Splunk Employee

Docs scrubbed. Sorry, old error. Passes smell test but was incorrect.

dwaddle
SplunkTrust
SplunkTrust

Can you post a link to where you found that in the docs? I didn't see it in the reference for props.conf, which confused me a little.

0 Karma

carmackd
Communicator

Thanks, this worked, but MAX_TIMESTAMP_LOOKAHEAD = 0 did not, which confuses me. Why would the documentation say setting the MAX_TIMESTAMP_LOOKAHEAD to 0 will cause splunk not to look into the event for a timestamp, and use the the current system time as the timestamp? I did not see this behavior when I used this configuration.

0 Karma

carmackd
Communicator

I was looking through the documentation and found the answer shortly after I posted.

If your events are indexed in real time, increase Splunk's overall indexing performance by turning off timestamp lookahead (set MAX_TIMESTAMP_LOOKAHEAD = 0). This causes Splunk to not look into event's for a timestamp, and sets an event's timestamp to be its indexing time (using current system time).

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...