Some splunk events indexing without any date in them which makes manually insert the date in search query to search?

[pavanae]

Some splunk events indexing without any date in them which makes manually insert the date in search query to search..

Now how can I make them indexing with certain date format?

Splunk version ;-6.1.8

What were the stanzas i should give and where?

[inventsekar · Accepted solution]

How Splunk software assigns timestamps
Splunk software uses the following precedence rules to assign timestamps to events:

1. It looks for a time or date in the event itself using an explicit TIME_FORMAT, if provided. You configure the TIME_FORMAT attribute in props.conf.

2. If no TIME_FORMAT was configured for the data, Splunk software attempts to automatically identify a time or date in the event itself. It uses the source type of the event (which includes TIME_FORMAT information) to try to find the timestamp.

3. If an event does not have a time or date, Splunk software uses the timestamp from the most recent previous event of the same source.

4. If no events in a source have a date, Splunk software tries to find a date in the source name or file name. Time of day is not identified in filenames. (This requires that the events have a time, even though they don't have a date.)

5. For file sources, if no date can be identified in the file name, Splunk software uses the file's modification time.

6. As a last resort, Splunk software sets the timestamp to the current system time when indexing each event.

Note: Splunk software can extract only dates from a source, not times. If you need to extract a time from a source, use a transform.

http://docs.splunk.com/Documentation/Splunk/6.4.3/Data/HowSplunkextractstimestamps