Quantcast
Channel: Questions in topic: "props.conf"
Viewing all articles
Browse latest Browse all 1485

How to get system time for each events indexed file splunk

$
0
0
Hello Everyone, I have text files where there is no datetime in it, but my required is need to get each line as one event with indexing time ( that willbe system time). I have used below `props.conf` but still its having same datetime for all the events in the file. [test] DATETIME_CONFIG = CURRENT SHOULD_LINEMERGE = false That is one file is having 100 lines as events and for all of that it has same timestamp. Can any one help me where am going wrong Thanks you

Viewing all articles
Browse latest Browse all 1485

Trending Articles