https://community.splunk.com/t5/Getting-Data-In/Time-config-incorrect/m-p/710123#M117295 <P>I updated it to a 4 digit year to match my logs.&nbsp;</P><LI-CODE lang="markup">%d %b %Y %H:%M:%S, %Z</LI-CODE><P>&nbsp;</P> Wed, 29 Jan 2025 11:28:47 GMT _joe 2025-01-29T11:28:47Z https://community.splunk.com/t5/Getting-Data-In/Time-config-incorrect/m-p/710122#M117294 <P>This isn't so much a question as a comment. I found that time config to be incorrect.&nbsp;<BR /><BR />My logs start like this:<BR /><SPAN>{"</SPAN><SPAN class="">Time</SPAN><SPAN>"</SPAN><SPAN class="">:</SPAN><SPAN> "</SPAN><SPAN class="">29</SPAN> <SPAN class="">Jan</SPAN> <SPAN class="">2025</SPAN> <SPAN class="">03:16:30</SPAN><SPAN>, </SPAN><SPAN class="">PST</SPAN><SPAN>",</SPAN></P><P>The default timestring is expecting a 2 digit year.</P><P>&nbsp;</P><LI-CODE lang="markup">%d %b %y %H:%M:%S, %Z</LI-CODE><P>&nbsp;</P><P><SPAN>Prior to the update, Splunk was stil able to figure out the time but issed the timezone parameter. In other words, if your heavy forwarder has the same timezone as your zScaler logs you would probably be fine.</SPAN></P><P>&nbsp;</P><P>&nbsp;</P> Wed, 29 Jan 2025 11:27:58 GMT https://community.splunk.com/t5/Getting-Data-In/Time-config-incorrect/m-p/710122#M117294 _joe 2025-01-29T11:27:58Z https://community.splunk.com/t5/Getting-Data-In/Time-config-incorrect/m-p/710123#M117295 <P>I updated it to a 4 digit year to match my logs.&nbsp;</P><LI-CODE lang="markup">%d %b %Y %H:%M:%S, %Z</LI-CODE><P>&nbsp;</P> Wed, 29 Jan 2025 11:28:47 GMT https://community.splunk.com/t5/Getting-Data-In/Time-config-incorrect/m-p/710123#M117295 _joe 2025-01-29T11:28:47Z