I have a file to index which has a date field ( currentdate) . How to configure the input regex so as to use this field as the timestamp for indexing..
Hey, just check this part of the docs for the right configuration: http://docs.splunk.com/Documentation/Splunk/7.1.0/Data/Configuretimestamprecognition
Especially the Edit timestamp properties in props.conf part will tell you how to use TIME_FORMAT and TIME_PREFIX to get your log set up.
Edit timestamp properties in props.conf
the date field format is "May-09-2018" , Need to make splunk take this as timestamp.. how to do that with regex for input
