Getting Data In

Is there a way to specify how Splunk handles future dates?

lyndac
Contributor

I have a system that sometimes gets its clock messed up and starts sending events that are in the future. Splunk is recognizing the future time and is setting _time to the time of the last indexed event.

Is there any way to tell Splunk to use the current time for _time whenever a future time is detected?

woodcock
Esteemed Legend

This is not possible but is a sensible feature request.

0 Karma

somesoni2
Revered Legend

You would need to set MAX_DAYS_HENCE attribute in the props.conf (to set on Indexer/Heavy forwarder) to adjust how long in future should splunk accept the timestamp. This can be set for a sourcetype OR for all using [default] stanza.

MAX_DAYS_HENCE = <integer>
* Specifies the maximum number of days in the future, from the current date as
  provided by input layer(For e.g. forwarder current time, or modtime for files),
  that an extracted date can be valid. Splunk still indexes events with dates
  more than MAX_DAYS_HENCE in the future with the timestamp of the last
  acceptable event. If no such acceptable event exists, new events with
  timestamps after MAX_DAYS_HENCE will use the current timestamp.

lyndac
Contributor

I'd like to be able to make splunk use the current timestamp whenever it sees a future event. I don't want it to use the "last acceptable event".

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) v3.54.0

The Splunk Threat Research Team (STRT) recently released Enterprise Security Content Update (ESCU) v3.54.0 and ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...