How to tel Splunk to index based on second column(Timestamp) instead of column(Server Started)

[smdasim]

How to tel Splunk to index based on second column(Timestamp) instead of column(Server Started). This is causing data to be index to old data May 26,2017 instead of Aug 25.
I want to fix it from Splunk UI only. Please advice

Server Started Timestamp Document Type User Message Id Session
2017-05-26 18:51:20 2017-08-25 09:08:53 \FILES.BM.QLIKVIEW.KVR.COMPANY.COM.IN Document XXRPXX\U123456 Open Document\SHDashboard 10009
2017-05-26 18:51:20 2017-08-25 09:08:53 \FILES.BM.QLIKVIEW.KVR.COMPANY.COM.IN Sheet XXRPXX\U123456 Activated sheet Document\SHSessionHeatmap 10009
2017-05-26 18:51:20 2017-08-25 09:08:54 \FILES.BM.QLIKVIEW.KVR.COMPANY.COM.IN Bookmark XXRPXX\U123456 Apply Server\BM02-00 10009
2017-05-26 18:51:20 2017-08-25 09:33:28 \FILES.BM.QLIKVIEW.KVR.COMPANY.COM.IN Document XXRPXX\U123456 Close Document\SHSessionHeatmap 10009

[skoelpin]

Not possible to fix from the frontend.. This can only be done on the backend

You should apply these base configs to your props.conf and should then restart splunkd.. Also make sure to replace my_sourcetype with your sourcetype you specified in inputs.conf

[my_sourcetype]
TIME_PREFIX = ^\d{4}-\d+-\d+\s\d+:\d+:\d+\s
MAX_TIMESTAMP_LOOKAHEAD = 20
TIME_FORMAT = %Y-%m-%d %H:%M:%S
LINE_BREAKER = ([\r\n]+)\d{4}-\d+-\d+\s
SHOULD_LINEMERGE = False
TRUNCATE = 10000

The TIME_PREFIX attribute is telling Splunk to start after the first timestamp and only pick up the second timestamp

[smdasim]

Please give me details from front end to add the required fix .

[skoelpin]

Did the below answer solve your question? If so, can you click accept?