We also use kinesis, and are pulling in vpcflow logs and recently found a solution to the log time. I will share my thoughts in hopes that it either turns out to be a solution for you or point you in the right direction.
Option 1:
This will use the current time of the splunk server to log the time of the event and convert/read epoch time.
Edit/Create a props.conf file in %SPLUNK%\etc\system\local
[]
TIME_PREFIX = CURRENT
TIME_FORMAT = %s
Option 2:
This will take either the start time of the event or end time, however you configure regexp.
Edit/Create a props.conf file in %SPLUNK%\etc\system\local
Start time of event
[]
TIME_PREFIX = ^([^ ]+\s){10}
TIME_FORMAT = %s
End time of event
[]
TIME_PREFIX = ^([^ ]+\s){11}
TIME_FORMAT = %s
Keeping in mind these are configured specifically formatted for vpc flow logs.
... View more
