Getting Data In

configuring timestamp



I have a number of logfiles that do not have timestamps. I am processing these logs with the univeral forwarder, on Windows servers. i want the timestamp to be equal to the time of the universal forwarders time when the entry was processed. How would I configure props.conf to do such a thing?

Tags (2)
0 Karma

Splunk Employee
Splunk Employee

This is possible, but the timestamp will be the index time at the indexer (not the read time at the forwarder).
You have to define a sourcetype for your log, and define it in props.conf on the indexer



0 Karma