I have the following problem:
I receive some text files (comma separated) which I need to index and search. Problem is that the files do not contain a field with a timestamp, and I would like to add as timestamp the file CREATION date and time instead of Splunk default file modtime (which apparently is the "last modified" attribute). I really don't have other ways, it's the first thing I thought about, this scenario (when I receive the files and index them afterwards) is the only feasible scenario. Any help would be highly appreciated, usually I find this type of info by myself, but I keep failing this time...
So, to summarize, I can't change the file names (the script which generates them is unaccessible), don't have access to the files original location (security reasons) - ergo I need to work on this particular scenario with file creation time instead of file last modified.
Suggestion : Add dummy time and date column and save to any other file format . and revert back to .csv with dummy date and time remaining. ,You need to add a dummy column for date and time and save it .