Hi harshal_chakranarayan,
Splunk uses the following precedence rules to assign time stamps to events:
Splunk looks for a time or date in the event itself using an explicit TIME_FORMAT, if provided. You configure TIME_FORMAT in props.conf.
If no TIME_FORMAT was configured for the data, Splunk attempts to automatically identify a time or date in the event itself. It uses the event's source type (which includes TIME_FORMAT information) to try to find the timestamp.
If an event doesn't have a time or date, Splunk uses the timestamp from the most recent previous event of the same source.
If no events in a source have a date, Splunk tries to find one in the source name or file name. (This requires that the events have a time, even though they don't have a date.)
For file sources, if no date can be identified in the file name, Splunk uses the file's modification time.
As a last resort, Splunk sets the timestamp to the current system time when indexing each event.
kudos go to docs team for this
cheers, MuS
