Alternate timestamp for CSV files or forwarded data

Splunk has a series of rules it goes through in determining how to timestamp an event from any source.

Splunk doc link to how timestamps are auto-recognized:

http://www.splunk.com/base/Documentation/latest/Admin/Configuretimestamprecognition

It sounds like option #5 in that doc is where you are trying to go:

1. For file sources, if no time or date can be identified in the file name, use the modification time on the file.

I don't see a way of explicitly forcing Splunk to go to that option, but you may be able to influence it into thinking there is NO valid timestamp within the file. Maybe with something like this (props.conf):

[mysourcetype]
TIME_PREFIX=^this should not ever happen$

This takes advantage of the TIME_PREFIX rule of "If the TIME_PREFIX cannot be found in the event text, timestamp extraction does not take place." Obviously, your input file can't have a line in it that says only "this should not ever happen"

One option that is easily settable is using the "current time" always. This is the time Splunk indexes the event, not necessarily the time of the file. See related question/answer at:

http://answers.splunk.com/questions/12104/using-index-time-as-time-stamp/12106#12106

what dwaddle says will totally work, but this is a simpler method:

http://www.splunk.com/base/Documentation/latest/Admin/Tunetimestampextractionforbetterindexingperformance#Disable_timestamp_determination

just turn off the timestamping and Splunk will just use the modtime of the file.