Getting Data In
Provide Splunk Cloud feedback in this confidential UX survey by June 17
for a chance to win a $200 Amazon gift card!

force timestamp to event receive time

monzy
Communicator

how can i force the timestamp of an event to be the receive time and ignore all other timestamps in the event.

Tags (1)
0 Karma
1 Solution

monzy
Communicator

the solution is to disable the timestamp processor:

http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/TuneTimestampExtractionForBetterIndexingPerfo...

"Splunk does not look at the text of the event for the timestamp. Instead, it uses the event's "time of receipt"

View solution in original post

0 Karma

monzy
Communicator

the solution is to disable the timestamp processor:

http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/TuneTimestampExtractionForBetterIndexingPerfo...

"Splunk does not look at the text of the event for the timestamp. Instead, it uses the event's "time of receipt"

View solution in original post

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!