Knowledge Management

How to collect summary events with a new sourcetype and server time

proylea
Contributor

I want to extract certain events into the same index with a different sourcetype, this is simple, but I would like to change the timestamp of the collect event to server time.

This is the search I am using but it keeps the original timestamp of the event.

index="cartt" | tail 100 | collect addtime=false index=cartt host=CARTT source=cartt_deleted sourcetype=cartt_deleted
0 Karma

micahkemp
Champion

Why do you want to change the sourcetype?

You can use [source:] in props.conf to create search time customizations for summary data.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

How about this?

index="cartt" | tail 100 | eval _time=now() | collect addtime=false index=cartt host=CARTT source=cartt_deleted sourcetype=cartt_deleted
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...