Hello, is it possible to tell Splunk to ignore timestamps that are in a log file and to consider as timestamp the indexing time?
Thanks in advance,
Luca.
Yes. You can tell Splunk not to extract a timestamp by setting DATETIME_CONFIG
to CURRENT
in your props.conf
for your sourcetype:
[your_sourcetype]
DATETIME_CONFIG = CURRENT
Yes. You can tell Splunk not to extract a timestamp by setting DATETIME_CONFIG
to CURRENT
in your props.conf
for your sourcetype:
[your_sourcetype]
DATETIME_CONFIG = CURRENT
Thanks ziegfried, was having trouble finding this.