Getting Data In

How to edit Splunk Cloud DATETIME_CONFIG=CURRENT?


I have a json source with input via a Splunk Add-on for AWS input. Sometimes there's a timestamp-like field, sometimes not, so I chose to use a sourcetype with Timestamp handling set to "Current time" in the GUI which I think sets DATETIME_CONFIG=CURRENT in the sourcetype's props.conf entry. 

I expected this to mean that's where the events would get their timestamp from, but log messages in splunkd.log (according to what I see in index=_internal) are still showing that DateParserVerbose is spitting out warnings that "A possible timestamp match ... is outside of the acceptable time window" occurring when events with no recognisable time are indexed. This also means that some events get seemingly random timestamps if some string gets misinterpreted; a handful of events generated yesterday had timestamps in November 2021.

Was I wrong expecting a sourcetype's DATETIME_CONFIG worked that way?

If not, what might be happening to stop my intended timestamping?

If so, how else should I handle events with no timestamps?

Thanks for any advice.

Labels (1)
0 Karma


You say you "chose to use a sourcetype".  How did you implement that decision?  It sounds like the add-on is not using that sourcetype.  When you look at the events that have the wrong timestamp, check the sourcetype value associated with them.  That is the sourcetype you need to modify to use DATETIME_CONFIG=CURRENT.

If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Splunk APM & RUM | Upcoming Planned Maintenance

There will be planned maintenance of the streaming infrastructure for Splunk APM and Splunk RUM in the coming ...

Part 2: Diving Deeper With AIOps

Getting the Most Out of Event Correlation and Alert Storm Detection in Splunk IT Service Intelligence   Watch ...

User Groups | Upcoming Events!

If by chance you weren't already aware, the Splunk Community is host to numerous User Groups, organized ...