Getting Data In

How to edit Splunk Cloud DATETIME_CONFIG=CURRENT?


I have a json source with input via a Splunk Add-on for AWS input. Sometimes there's a timestamp-like field, sometimes not, so I chose to use a sourcetype with Timestamp handling set to "Current time" in the GUI which I think sets DATETIME_CONFIG=CURRENT in the sourcetype's props.conf entry. 

I expected this to mean that's where the events would get their timestamp from, but log messages in splunkd.log (according to what I see in index=_internal) are still showing that DateParserVerbose is spitting out warnings that "A possible timestamp match ... is outside of the acceptable time window" occurring when events with no recognisable time are indexed. This also means that some events get seemingly random timestamps if some string gets misinterpreted; a handful of events generated yesterday had timestamps in November 2021.

Was I wrong expecting a sourcetype's DATETIME_CONFIG worked that way?

If not, what might be happening to stop my intended timestamping?

If so, how else should I handle events with no timestamps?

Thanks for any advice.

Labels (1)
0 Karma


You say you "chose to use a sourcetype".  How did you implement that decision?  It sounds like the add-on is not using that sourcetype.  When you look at the events that have the wrong timestamp, check the sourcetype value associated with them.  That is the sourcetype you need to modify to use DATETIME_CONFIG=CURRENT.

If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...

Cloud Platform | Discontinuing support for TLS version 1.0 and 1.1

Overview Transport Layer Security (TLS) is a security communications protocol that lets two computers, ...

Splunk Cloud Platform | New Customer Testimonials

Enterprises of all sizes and across different industries are accelerating cloud adoption by migrating ...