Some splunk events indexing without any date in them which makes manually insert the date in search query to search..
Now how can I make them indexing with certain date format?
Splunk version ;-6.1.8
What were the stanzas i should give and where?
How Splunk software assigns timestamps
Splunk software uses the following precedence rules to assign timestamps to events:
It looks for a time or date in the event itself using an explicit TIME_FORMAT, if provided. You configure the TIME_FORMAT attribute in props.conf.
If no TIME_FORMAT was configured for the data, Splunk software attempts to automatically identify a time or date in the event itself. It uses the source type of the event (which includes TIME_FORMAT information) to try to find the timestamp.
If an event does not have a time or date, Splunk software uses the timestamp from the most recent previous event of the same source.
If no events in a source have a date, Splunk software tries to find a date in the source name or file name. Time of day is not identified in filenames. (This requires that the events have a time, even though they don't have a date.)
For file sources, if no date can be identified in the file name, Splunk software uses the file's modification time.
As a last resort, Splunk software sets the timestamp to the current system time when indexing each event.
Note: Splunk software can extract only dates from a source, not times. If you need to extract a time from a source, use a transform.
http://docs.splunk.com/Documentation/Splunk/6.4.3/Data/HowSplunkextractstimestamps
How Splunk software assigns timestamps
Splunk software uses the following precedence rules to assign timestamps to events:
It looks for a time or date in the event itself using an explicit TIME_FORMAT, if provided. You configure the TIME_FORMAT attribute in props.conf.
If no TIME_FORMAT was configured for the data, Splunk software attempts to automatically identify a time or date in the event itself. It uses the source type of the event (which includes TIME_FORMAT information) to try to find the timestamp.
If an event does not have a time or date, Splunk software uses the timestamp from the most recent previous event of the same source.
If no events in a source have a date, Splunk software tries to find a date in the source name or file name. Time of day is not identified in filenames. (This requires that the events have a time, even though they don't have a date.)
For file sources, if no date can be identified in the file name, Splunk software uses the file's modification time.
As a last resort, Splunk software sets the timestamp to the current system time when indexing each event.
Note: Splunk software can extract only dates from a source, not times. If you need to extract a time from a source, use a transform.
http://docs.splunk.com/Documentation/Splunk/6.4.3/Data/HowSplunkextractstimestamps