Hi , I have a report that is ingested in splunk. Due to the report format not correctly ingested by splunk, I had done some preprocessing of the report and named reportfile.rep and picked up by splunk every 15 mins. This report is delayed almost 40 minutes(as the processing and transferring of data takes time) , so the time stamp indexed by splunk is around 40 minutes delayed from the report. example: sample file: reportfile.rep ReportID=a004_012721.1400,Queue=xxx,AgentList=xxxx ReportID=a004_012721.1400,Queue=xxx _time = 2021-01-27T14:40:04.000+11:00 So report was for 14:00 however _time is 14:40. Is there anyway I can overwrite _time value to be picked up from the report file. I had seen some examples in splunk answers using transforms.conf and props.conf. However this is based on using the actual file name and not the content inside the file.
... View more
