Solved: Re: force timestamp to event receive time - Splunk Community

Getting Data In

how can i force the timestamp of an event to be the receive time and ignore all other timestamps in the event.

1 Solution

Solution

the solution is to disable the timestamp processor:

http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/TuneTimestampExtractionForBetterIndexingPerfo...

"Splunk does not look at the text of the event for the timestamp. Instead, it uses the event's "time of receipt"

View solution in original post

Solution

the solution is to disable the timestamp processor:

http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/TuneTimestampExtractionForBetterIndexingPerfo...

"Splunk does not look at the text of the event for the timestamp. Instead, it uses the event's "time of receipt"

Get Updates on the Splunk Community!

A Four-Part Event Series: Full Stack Observability For the AI Era

As AI reshapes applications, infrastructure, and the way teams operate, the traditional boundaries of ...

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

AI has fundamentally raised the stakes for security operations, and this three-part series is your guide to ...