why splunk extracts the second timestamp instead of first

[net1993]

I investigate issue of creating too many new warm buckets and while I do that, one of the events which according to log splunkd has issues has strange problem which I am curious to find out why this happens.

The event:
fdsfds fsdf as dsfsd fdsfds fdsfds fdsfd dsfds dsf.dd

[richgalloway]

The body of your question appears unrelated to the topic.
Where are the timestamps in your sample event? What are the props.conf settings for the event's sourcetype?

[net1993]

Sorry, splunks website filters timestamps for some reason. I tried to paste it many times but its same.
Basicaly: I have 1 event with first 1 unix timestamp and then there is another timestamps with format: Y-m-d h:i:s... and splunk for some reason takes the second timestamp even thought its after the epoch timestamp which is my question why it does that. The sourcetype is default and nothing custom in it.

[richgalloway]

It sounds like the two timestamps have different formats and Splunk is finding the one that matches what is in datetime.xml. You need to override that using the props.conf settings TIME_PREFIX, TIME_FORMAT, and MAX_TIMESTAMP_LOOKAHEAD. As soon as you post examples of the timestamps we can tell you what the settings should be.

[jnudell_2]

Enclose your sample event in either backticks ():
2019-08-02T00:00:00.000 timestamp1 Jan 1, 1970 00:01:02.003 timestamp2`
or code tags:
< pre> ... < /pre>
(remove the space after the opening less than sign)

2019-08-02T00:00:00.000 timestamp1 Jan 1, 1970 00:01:02.003 timestamp2

[net1993]

For some reason I cannot post the whole event so I place it as comment:
fdsfds fsdf as dsfsd fdsfds fdsfds fdsfd dsfds dsf.dd