should the data be indexed include timestamp

[amywong]

e.g. if the data be indexed is an application log, all the messages logged in this log file should contain a timestamp, otherwise the search result cannot display the "events" in a correct reverse chronicle sequence for troublshooting, right?

[Ayn]

Short answer: yes, events need a timestamp.

Slightly longer answer: events do not necessarily need a timestamp in order for Splunk to index them, however without a timestamp Splunk won't have the slightest idea when the event really occurred, so it will use the indexing time as timestamp. This can often be fine if Splunk is indexing events immediately as they arrive in an input source, however if you're adding some historical data the timestamp will be incorrect as the index time differs from the event generation time.

[gkanapathy]

Not exactly true, but close. An explicit timestamp on each event is best, but Splunk does many things to try to guess the time before going to the "current" time, including looking at the file name, looking at the modification time of the file, and looking at the timestamp of previous events.