Change _time field to a custom extracted field in Splunk Cloud

[HankinAlex]

Is there a way to change the _time field of imported data to be a custom extracted datetime field?

Or at least some way to specify a different field used by the time picker?

I have seen some solutions use props.conf but I am on Splunk Cloud 

[richgalloway · Accepted solution]

The solutions that use props.conf are available to Splunk Cloud users.  Put the props.conf file into an app and upload the app to your Splunk Cloud search head.  Once it passes vetting, click to install it and the props will be put in the right place(s).

[HankinAlex]

Is there documentation which instructs the creation of a custom app that can be uploaded to Splunk Cloud?

[richgalloway]

You can start here, but skip the parts about static assets, setup pages, and icons.

All you really need are default/app.conf and default/props.conf.  The site above shows what needs to be in app.conf.

[HankinAlex]

Still struggling a bit, so I only need to create a custom app with those two .conf files?
This is separate from my universal forwarder that's actually retrieving the data, correct?

Also, what is meant by putting the app on the search head, the only location I know where to install apps is under Apps > Manage Apps

[richgalloway]

The app with props.conf is separate from the app(s) you may be using on a UF to read data.

Putting the app on the SH is my attempt to make it clear the app does not go on the UF.  It *can* be installed on the UF, but it won't have any effect there.  Yes, go to Apps->Manage apps->Uploaded Apps to install your app.

[HankinAlex]

Once the app is installed, is there any more steps that need to be taken to ensure, that its applied to searches? Is there a common way to debug the app? Its hard to troubleshoot by simply editing props.conf, uninstalling and reinstalling over and over

[richgalloway]

The best way to debug props is with the Add Data wizard.   Save some sample events in a file on your workstation then go to Settings->Add Data.  Select "Upload" and choose your sample events file.  Splunk will then upload your file and show how events break with the default settings.  Change the settings on the left and click the Apply button to see how that changes the events.  When you're happy with the props, click the "Save to clipboard" link to show the settings in a modal you can copy-paste into props.conf in your app.

[HankinAlex]

Attempting to make changes in "Set Source Type" and pressing "Apply settings" never seems to make changes to my sample data preview.

Im getting a red exclamation in the top left corner saying "Can only preview uploaded files", could that be a problem?

[richgalloway]

Yes, that could be a problem.  Did you upload a file?

[HankinAlex]

I went through Settings > Add Data > Upload, and uploaded a simple 3 row csv

Then I was brought to the source type page referenced previously