Getting Data In

index future date events as today's date in _time

ayush1906
Path Finder

I am getting a future timestamped event, but I want to index it as default time of index. i.e. at the time when it got indexed.

Presently I have changed

MAX_DAYS_HENCE = 0

in my props.conf. But I found out that the event having tomorrow's date are getting index with tomorrow's date instead of today's date.

alt text

Like today its 23 July, I am looking for any events after today to be indexed for time 23 July. But in my case 24 July is taken as a valid date which should not be the case.

Any other workaround would be appreciated.

The source data is JSON response of API which I am indexing via python script and taking PED field as _time

0 Karma
1 Solution

adonio
SplunkTrust
SplunkTrust
0 Karma

adonio
SplunkTrust
SplunkTrust
0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!