Getting Data In

How to edit Splunk Cloud DATETIME_CONFIG=CURRENT?

SeanBatt
Explorer

I have a json source with input via a Splunk Add-on for AWS input. Sometimes there's a timestamp-like field, sometimes not, so I chose to use a sourcetype with Timestamp handling set to "Current time" in the GUI which I think sets DATETIME_CONFIG=CURRENT in the sourcetype's props.conf entry. 

I expected this to mean that's where the events would get their timestamp from, but log messages in splunkd.log (according to what I see in index=_internal) are still showing that DateParserVerbose is spitting out warnings that "A possible timestamp match ... is outside of the acceptable time window" occurring when events with no recognisable time are indexed. This also means that some events get seemingly random timestamps if some string gets misinterpreted; a handful of events generated yesterday had timestamps in November 2021.

Was I wrong expecting a sourcetype's DATETIME_CONFIG worked that way?

If not, what might be happening to stop my intended timestamping?

If so, how else should I handle events with no timestamps?

Thanks for any advice.

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

You say you "chose to use a sourcetype".  How did you implement that decision?  It sounds like the add-on is not using that sourcetype.  When you look at the events that have the wrong timestamp, check the sourcetype value associated with them.  That is the sourcetype you need to modify to use DATETIME_CONFIG=CURRENT.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...