Getting Data In

How to edit Splunk Cloud DATETIME_CONFIG=CURRENT?


I have a json source with input via a Splunk Add-on for AWS input. Sometimes there's a timestamp-like field, sometimes not, so I chose to use a sourcetype with Timestamp handling set to "Current time" in the GUI which I think sets DATETIME_CONFIG=CURRENT in the sourcetype's props.conf entry. 

I expected this to mean that's where the events would get their timestamp from, but log messages in splunkd.log (according to what I see in index=_internal) are still showing that DateParserVerbose is spitting out warnings that "A possible timestamp match ... is outside of the acceptable time window" occurring when events with no recognisable time are indexed. This also means that some events get seemingly random timestamps if some string gets misinterpreted; a handful of events generated yesterday had timestamps in November 2021.

Was I wrong expecting a sourcetype's DATETIME_CONFIG worked that way?

If not, what might be happening to stop my intended timestamping?

If so, how else should I handle events with no timestamps?

Thanks for any advice.

Labels (1)
0 Karma


You say you "chose to use a sourcetype".  How did you implement that decision?  It sounds like the add-on is not using that sourcetype.  When you look at the events that have the wrong timestamp, check the sourcetype value associated with them.  That is the sourcetype you need to modify to use DATETIME_CONFIG=CURRENT.

If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Enterprise Security Content Updates (ESCU) - New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 3 releases of new content via the Enterprise ...

Thought Leaders are Validating Your Hard Work and Training Rigor

As a Splunk enthusiast and member of the Splunk Community, you are one of thousands who recognize the value of ...

.conf23 Registration is Now Open!

Time to toss the .conf-etti 🎉 —  .conf23 registration is open!   Join us in Las Vegas July 17-20 for ...