https://community.splunk.com/t5/Getting-Data-In/Event-timestamp-issue/m-p/143714#M29334 <P>Hi,<BR /> I encountered some event timestamp issue at the Data preview for Windows2007 SP2 stated below. When i using the input file and configure at some other server, the timestamp and event date is the correct. what went wrong and how to resolve it?</P> <PRE><CODE>Timestamp Event 9/25/01 4:31:20:000 AM 9/29/2014 12:42:00 AM ........... 9/25/01 4:33:50:000 AM 9/29/2014 12:43:33 AM ............. </CODE></PRE> <P>thks &amp; rgds</P> Mon, 29 Sep 2014 03:43:43 GMT newbiesplunk 2014-09-29T03:43:43Z https://community.splunk.com/t5/Getting-Data-In/Event-timestamp-issue/m-p/143714#M29334 <P>Hi,<BR /> I encountered some event timestamp issue at the Data preview for Windows2007 SP2 stated below. When i using the input file and configure at some other server, the timestamp and event date is the correct. what went wrong and how to resolve it?</P> <PRE><CODE>Timestamp Event 9/25/01 4:31:20:000 AM 9/29/2014 12:42:00 AM ........... 9/25/01 4:33:50:000 AM 9/29/2014 12:43:33 AM ............. </CODE></PRE> <P>thks &amp; rgds</P> Mon, 29 Sep 2014 03:43:43 GMT https://community.splunk.com/t5/Getting-Data-In/Event-timestamp-issue/m-p/143714#M29334 newbiesplunk 2014-09-29T03:43:43Z https://community.splunk.com/t5/Getting-Data-In/Event-timestamp-issue/m-p/143715#M29335 <P>I think splunk doesn't pick the correct timestamp if as you say.Is it because the raw log has the same like string somewhere?<BR /> You can try to use the TIME_FORMAT property in $SPLUNK_HOME/etc/system/local/props.conf.<BR /> good luck <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Mon, 28 Sep 2020 17:43:44 GMT https://community.splunk.com/t5/Getting-Data-In/Event-timestamp-issue/m-p/143715#M29335 zillionlee 2020-09-28T17:43:44Z