Using the Splunk SDK, I am ingesting json data into a splunk index via this line of code: index.submit(event, host="localhost", sourcetype="covid_vacc_data_ingest") This line of code is working and data is ingested, but the timestamp is always the ingestion time rather then the date field on the event. Here is a screenshot of my settings in Splunk enterprise for this sourcetype: Here is a screenshot of what the ingested data looks like: I want the _time field on the left to be the date field on the right. Any suggestions? Not sure what I am doing wrong. Thank you!
... View more