topic Re: Can Timestamp Assignement Precedence Be Altered? in Getting Data In

Can Timestamp Assignement Precedence Be Altered?

pdurrer — Tue, 29 Sep 2020 11:01:00 GMT

Is there a way to override the timestamp assignment precedence rules, as described here:

http://docs.splunk.com/Documentation/Splunk/6.4.3/Data/HowSplunkextractstimestamps

Specifically, I'd like to disable #3 ... assignment based on the last event time. The reason this is causing me a problem is in some of my events I use TIME_PREFIX to override _time with a timestamp in the event data. In some cases, this event data is very old. So when other data arrives which does not have the specified TIME_PREFIX, rather than getting assigned the current date/time, it sometimes gets recorded with one of these historical dates.

Thanks.

Re: Can Timestamp Assignement Precedence Be Altered?

dmaislin_splunk — Wed, 14 Sep 2016 13:23:05 GMT

You need DATETIME_CONFIG. Read a blog entry I wrote on this very thing: http://blogs.splunk.com/2014/04/23/its-that-time-again

Re: Can Timestamp Assignement Precedence Be Altered?

pdurrer — Wed, 14 Sep 2016 14:50:29 GMT

Thanks, but I must be missing something. How can a DATETIME_CONFIG file be configured to set the event timestamp to the current date/time when no timestamp is detected in the event data?