Assigning future timestamps fails

[ankithreddy777]

I am extracting timestamps from event to assign _time to events during index time. But timestamps are future date. Suppose if current date is 5/10/2017 , and event has timefield: 5/11/2017 it is working. But event has timefield whose future date is far like 6/5/2017, then assignment fails. How we can this this. I need to assign future timestamps to my events.

[somesoni2]

You would need to set following attribute in your props.conf/sourcetype definition

MAX_DAYS_HENCE = <integer>
* Specifies the maximum number of days in the future, from the current date as
  provided by input layer(For e.g. forwarder current time, or modtime for files),
  that an extracted date can be valid. Splunk still indexes events with dates
  more than MAX_DAYS_HENCE in the future with the timestamp of the last
  acceptable event. If no such acceptable event exists, new events with
  timestamps after MAX_DAYS_HENCE will use the current timestamp.
* For example, if MAX_DAYS_HENCE = 3, Splunk applies the timestamp of the last
  acceptable event to events with extracted timestamps more than 3 days in the
  future. If no acceptable event exists, Splunk applies the current timestamp.
* The default value includes dates from one day in the future.
* If your servers have the wrong date set or are in a timezone that is one
  day ahead, increase this value to at least 3.
* Defaults to 2 (days), maximum 10950.
* IMPORTANT: False positives are less likely with a tighter window, change
             with caution.