Hi, I just started using this app today, and the data I receive when I search "sourcetype=airport" has the year 2013 for one airport and 2012 for another. I notice in the actual syslog data there isn't even year mentioned so is it being generated elsewhere?. Any thoughts on where I go to fix this?
this is probably because of the missing year in the airport syslog output.
Splunk uses the following precedence rules to assign timestamps to events:
Splunk looks for a time or date in the event itself using an explicit TIME_FORMAT, if provided. You configure the TIME_FORMAT attribute in props.conf.
If no TIME_FORMAT was configured for the data, Splunk Enterprise attempts to automatically identify a time or date in the event itself. It uses the source type of the event (which includes TIME_FORMAT information) to try to find the timestamp.
If an event doesn't have a time or date, Splunk Enterprise uses the timestamp from the most recent previous event of the same source.
If no events in a source have a date, Splunk Enterprise tries to find one in the source name or file name. (This requires that the events have a time, even though they don't have a date.)
For file sources, if no date can be identified in the file name, Splunk Enterprise uses the file's modification time.
As a last resort, Splunk Enterprise sets the timestamp to the current system time when indexing each event.