Splunk Cloud timestamp

[kevincorder]

When running a search for syslogs within 7 days, Splunk is retuning some logs that are months old. Timestamp is correct in the event description (Linux Day, Month, Time) but the Splunk timestamp indicates the logs were within the 7 days search parameters. Other results within the same search are correctly returned, doesn't seem to be any pattern.

[DalJeanis]

Check for where in the log the timestamp is. Often this occurs when the timestamp sometimes occurs farther into the log than the date time lookahead is set for.

[richgalloway]

Can you share some sample, sanitized events? Please also share the props.conf settings for the sourcetype.

[kevincorder]

Can I access the props.conf in Splunk Cloud? If so, how?

[richgalloway]

Try searching | rest /services/configs/conf-props.