force timestamp to event receive time

[monzy]

how can i force the timestamp of an event to be the receive time and ignore all other timestamps in the event.

[monzy · Accepted solution]

the solution is to disable the timestamp processor:

http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/TuneTimestampExtractionForBetterIndexingPerfo...

"Splunk does not look at the text of the event for the timestamp. Instead, it uses the event's "time of receipt"