Use import date/time

[dbcase]

Hi,

Is there a way to use the import date and time vs. having splunk try to interpret a date in the event? The date in our event is meaningless as far as using it for any data analysis.

[somesoni2 · Accepted solution]

There is an attribute in props.conf called DATETIME_CONFIG which you can set to value CURRENT and Splunk will treat current time (time of import) as the event timestamp.

[yoursourcetype]
...line breaking configs..
DATETIME_CONFIG = CURRENT

[dbcase]

Perfect! Thanks Somesoni2!