For the small sample you have provided, the sourcetype settings are correct. So you might want to edit your answer, and provide a richer data sample so we can see more of the file.
Check out this list: How Timestamp Assignment Works
Splunk looks for a time or date in the event itself using an explicit TIME_FORMAT, if provided. You configure the TIME_FORMAT attribute in props.conf.
If no TIME_FORMAT was configured for the data, Splunk Enterprise attempts to automatically identify a time or date in the event itself. It uses the source type of the event (which includes TIME_FORMAT information) to try to find the timestamp.
If an event doesn't have a time or date, Splunk Enterprise uses the timestamp from the most recent previous event of the same source.
If no events in a source have a date, Splunk Enterprise tries to find one in the source name or file name. (This requires that the events have a time, even though they don't have a date.)
For file sources, if no date can be identified in the file name, Splunk Enterprise uses the file's modification time.
As a last resort, Splunk Enterprise sets the timestamp to the current system time when indexing each event.
Note: Splunk Enterprise can only extract dates from a source, not times. If you need to extract a time from a source, use a transform.
Splunk will resort to using the timestamp in the source only if you don't give the TIME_FORMAT or if the one you have given seems incorrect. For example, if you have the majority of events that don't match the TIME_FORMAT Splunk will think "oh, that can't be right" and it will ignore it and go to the next step on the list.
Note also, that if you have a header on these files, you can tell Splunk in which field(s) it will find the timestamp, regardless of the format.
So It would be my assumption at this point. that the file isn't as consistent as you expect. What I would do, is use Splunk to show me that first field.
Since the data is in, try this:
sourcetype=YOURSOURCETYPE |rex "(?<mytimestamp>^[^\;]+);"| stats count by mytimestamp
- this will help you see what's in there that is convincing Splunk that TIME_FORMAT doesn't match. Then you will have another puzzle. 🙂 If so, I suggest you reform your question and create a new entry in "answers".
With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!
