I've notice when I import a file of system logs the date is when they were imported. How can I set Splunk to recognize the date is the first field in the raw data? Is there some pre-processing I need to do to the data for this to happen?
Splunk should find the field but you can force it using the props.config file.
In this example I am importing a csv file with the timestamp as the first field however it was a wonky (date only) format and Splunk was not recognizing it as the time. I had to tell Splunk the format (TIME_FORMAT) it was in and whcih field to use as the timestamp (TIMESTAMP_FIELDS), even though the timestamp is the first field.
Sourctype = EstgToSplunk_Employee
[EstgToSplunk_Employee]
NO_BINARY_CHECK = 1
pulldown_type = 1
FIELD_DELIMITER=,
FIELD_QUOTE="
HEADER_FIELD_LINE_NUMBER = 2
TIME_FORMAT = %Y-%m-%d
TIMESTAMP_FIELDS=DATE