Can Timestamp Assignement Precedence Be Altered?

[pdurrer]

Is there a way to override the timestamp assignment precedence rules, as described here:

http://docs.splunk.com/Documentation/Splunk/6.4.3/Data/HowSplunkextractstimestamps

Specifically, I'd like to disable #3 ... assignment based on the last event time. The reason this is causing me a problem is in some of my events I use TIME_PREFIX to override _time with a timestamp in the event data. In some cases, this event data is very old. So when other data arrives which does not have the specified TIME_PREFIX, rather than getting assigned the current date/time, it sometimes gets recorded with one of these historical dates.

Thanks.

[dmaislin_splunk]

You need DATETIME_CONFIG. Read a blog entry I wrote on this very thing: http://blogs.splunk.com/2014/04/23/its-that-time-again

[pdurrer]

Thanks, but I must be missing something. How can a DATETIME_CONFIG file be configured to set the event timestamp to the current date/time when no timestamp is detected in the event data?