Solved: force timestamp to event receive time - Splunk Community

Getting Data In

how can i force the timestamp of an event to be the receive time and ignore all other timestamps in the event.

1 Solution

Solution

the solution is to disable the timestamp processor:

http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/TuneTimestampExtractionForBetterIndexingPerfo...

"Splunk does not look at the text of the event for the timestamp. Instead, it uses the event's "time of receipt"

View solution in original post

Solution

the solution is to disable the timestamp processor:

http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/TuneTimestampExtractionForBetterIndexingPerfo...

"Splunk does not look at the text of the event for the timestamp. Instead, it uses the event's "time of receipt"

Get Updates on the Splunk Community!

Think Like an Architect: Introducing the Splunk Certified Cybersecurity Defense ...

In cybersecurity, defenders respond to threats. Architects design the systems that stop them. As ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...