I am extracting timestamps from event to assign _time to events during index time. But timestamps are future date. Suppose if current date is 5/10/2017 , and event has timefield: 5/11/2017 it is working. But event has timefield whose future date is far like 6/5/2017, then assignment fails. How we can this this. I need to assign future timestamps to my events.
You would need to set following attribute in your props.conf/sourcetype definition
MAX_DAYS_HENCE = <integer>
* Specifies the maximum number of days in the future, from the current date as
provided by input layer(For e.g. forwarder current time, or modtime for files),
that an extracted date can be valid. Splunk still indexes events with dates
more than MAX_DAYS_HENCE in the future with the timestamp of the last
acceptable event. If no such acceptable event exists, new events with
timestamps after MAX_DAYS_HENCE will use the current timestamp.
* For example, if MAX_DAYS_HENCE = 3, Splunk applies the timestamp of the last
acceptable event to events with extracted timestamps more than 3 days in the
future. If no acceptable event exists, Splunk applies the current timestamp.
* The default value includes dates from one day in the future.
* If your servers have the wrong date set or are in a timezone that is one
day ahead, increase this value to at least 3.
* Defaults to 2 (days), maximum 10950.
* IMPORTANT: False positives are less likely with a tighter window, change