How to edit Splunk Cloud DATETIME_CONFIG=CURRENT?

SeanBatt — Thu, 02 Feb 2023 02:17:44 GMT

I have a json source with input via a Splunk Add-on for AWS input. Sometimes there's a timestamp-like field, sometimes not, so I chose to use a sourcetype with Timestamp handling set to "Current time" in the GUI which I think sets DATETIME_CONFIG=CURRENT in the sourcetype's props.conf entry.

I expected this to mean that's where the events would get their timestamp from, but log messages in splunkd.log (according to what I see in index=_internal) are still showing that DateParserVerbose is spitting out warnings that "A possible timestamp match ... is outside of the acceptable time window" occurring when events with no recognisable time are indexed. This also means that some events get seemingly random timestamps if some string gets misinterpreted; a handful of events generated yesterday had timestamps in November 2021.

Was I wrong expecting a sourcetype's DATETIME_CONFIG worked that way?

If not, what might be happening to stop my intended timestamping?

If so, how else should I handle events with no timestamps?

Thanks for any advice.

Re: How to edit Splunk Cloud DATETIME_CONFIG=CURRENT?

richgalloway — Thu, 02 Feb 2023 14:34:16 GMT

You say you "chose to use a sourcetype". How did you implement that decision? It sounds like the add-on is not using that sourcetype. When you look at the events that have the wrong timestamp, check the sourcetype value associated with them. That is the sourcetype you need to modify to use DATETIME_CONFIG=CURRENT.

topic Re: How to edit Splunk Cloud DATETIME_CONFIG=CURRENT? in Getting Data In

How to edit Splunk Cloud DATETIME_CONFIG=CURRENT?

Re: How to edit Splunk Cloud DATETIME_CONFIG=CURRENT?