I have some month old syslog data that I need to load into an indexer, but the timestamp doesn't have the year. Is there a way to force the indexer to leverage the defined month, day and time against the current year? Can this be done through an index time props TIME_FORMAT?
You can refer to following site.
http://docs.splunk.com/Documentation/Splunk/latest/Data/HowSplunkextractstimestamps
Splunk uses the following precedence to assign timestamps to events:
Use positional timestamp extraction for events that have more than one timestamp value in the raw data.
Use positional timestamp extraction for events that have more than one timestamp value in the raw data.
If an event doesn't have a time or date, use the timestamp from the most recent previous event of the same source.
If no events in a source have a date, look in the source (or file) name (Must have time in the event).
For file sources, if no time or date can be identified in the file name, use the modification time on the file.
If no other timestamp is found, set the timestamp to the current system time (at the event's index time).
For file sources, if no time or date can be identified in the file name, use the modification time on the file.
If no other timestamp is found, set the timestamp to the current system time (at the event's index time).