timestamp issue

[indeed_2000]

Hi
I have issue with timestamp, here is the problem:
every day at "1 AM" all log files copy into the logserver. this logs belong to the yesterday but splunk consider today date (import date) as timestamp!

1-as you see in screenshot logfile name is 20200310.bz2 but timestamp is 3/11/20 (log belong yesterday but import today).
2-as you see in screenshot every line start with time not date and I can't use timestamp of events.

now question is how can I handle this with splunk?

Thanks,

[anmolpatel]

"Archive files (such as a .tar or .zip file, are decompressed before being indexed."
https://docs.splunk.com/Documentation/Splunk/latest/Data/Monitorfilesanddirectories#How_Splunk_Enter...

So it is reading the timestamp of the recorded event and not the timestamp of the source file.

If you would like to extract the timestamp when the bz2 file is created, use this splunk answer:
https://answers.splunk.com/answers/705686/how-do-you-extract-a-timestamp-from-a-filename.html

Unless you've a specific use case where the timestamp of the source file is needed, would recommend, using the event time, because all your events will be occurring at 1am. With millions of record to search through, it will quickly turn into a pain point.

[indeed_2000]

1-bz2 file create next day so not resolve issue if we consider create date of file.
2-this log file only store time of event not date (application create a log file each day, and file name is today date and every line of log file start with time.)

e.g.
file name = 20200311
01:00:00 info logmessage
02:00:00 info logmessage
03:00:00 info logmessage
...