Assign to missing timestamp event previous event timestamp

[michael_vi]

Hi,

By default, if no timestamp exist in a field, Splunk defaulting timestamp of previous event

On one hand, I do want Splunk to do it, but on the other hand I don't want Splunk to treat it as a "Timestamp Parsing Issues" in the Data quality.

Is there any way explicitly to tell Splunk to do it? I just want Splunk to treat it as error.

Thanks

[isoutamo · Accepted solution]

If you want to use current time instead of time of previous event which are different to current time the you could in props.conf
DATETIME_CONFIG = [<filename relative to $SPLUNK_HOME> | CURRENT | NONE]
Select value CURRENT. But if the event time can be something else than current then probably not.