Timestamp is not recognized

[zhou51]

Use splunk enterprise version 7.2.3，Use the field to extract the timestamp, the time closer to the present can be identified, and the historical time cannot be identified, how to solve

help！help

[to4kawa]

what's INDEXED_EXTRACTION in props.conf ?

and you should fix indexes.conf

https://docs.splunk.com/Documentation/Splunk/latest/Admin/Indexesconf

frozenTimePeriodInSecs = < nonnegative integer>
* The number of seconds after which indexed data rolls to frozen.
* If you do not specify a 'coldToFrozenScript', data is deleted when rolled to frozen.
* NOTE: Every event in a bucket must be older than frozenTimePeriodInSecs seconds before the bucket rolls to frozen.
* The highest legal value is 4294967295.
* Default: 188697600 (6 years)

reference: https://conf.splunk.com/files/2017/slides/splunk-data-life-cycle-determining-when-and-where-to-roll-...