topic Re: Assign to missing timestamp event previous event timestamp in Getting Data In

Assign to missing timestamp event previous event timestamp

michael_vi — Wed, 22 Jan 2025 10:20:40 GMT

Hi,

By default, if no timestamp exist in a field, Splunk defaulting timestamp of previous event

On one hand, I do want Splunk to do it, but on the other hand I don't want Splunk to treat it as a "Timestamp Parsing Issues" in the Data quality.

Is there any way explicitly to tell Splunk to do it? I just want Splunk to treat it as error.

Thanks

Re: Assign to missing timestamp event previous event timestamp

isoutamo — Wed, 22 Jan 2025 16:55:01 GMT

If you want to use current time instead of time of previous event which are different to current time the you could in props.conf
DATETIME_CONFIG = [<filename relative to $SPLUNK_HOME> | CURRENT | NONE]
Select value CURRENT. But if the event time can be something else than current then probably not.