I think that it is better not to have time element rather than having it as current time. This way, we will let splunkd to do what it suppose to do.