If you set it to NON, I think that there is a possibility that it will be set from the update time of the file.
Excerpt from ”Timestamp extraction configuration”
"CURRENT" will set the time of the event to the time that the event was
merged from lines, or worded differently, the time it passed through the
"NONE" will leave the event time set to whatever time was selected by
the input layer
For data sent by splunk forwarders over the splunk protocol, the input
layer will be the time that was selected on the forwarder by its input
behavior (as below).
For file-based inputs (monitor, batch) the time chosen will be the
modification timestamp on the file being read.
For other inputs, the time chosen will be the current system time when
the event is read from the pipe/socket/etc.
Both "CURRENT" and "NONE" explicitly disable the per-text timestamp
identification, so the default event boundary detection
(BREAKONLYBEFOREDATE = true) is likely to not work as desired. When
using these settings, use SHOULDLINEMERGE and/or the BREAKONLY* ,
MUSTBREAK* settings to control event merging.