https://community.splunk.com/t5/Getting-Data-In/Time-Format-being-ignored-why/m-p/146347#M29795 <P>1) Splunk is showing me the 'offset' time based upon my TZ setting.<BR /> 2) For some reason, for this source type ONLY, splunk is showing the AM/PM declaration. Not sure why.</P> Mon, 18 Nov 2013 15:44:50 GMT tyronetv 2013-11-18T15:44:50Z https://community.splunk.com/t5/Getting-Data-In/Time-Format-being-ignored-why/m-p/146346#M29794 <P>Sample log line date part:</P> <P>Nov 16 22:48:36</P> <P>props.conf on indexer<BR /> <PRE><BR /> TIME_PREFIX = ^ <BR /> TIME_FORMAT = %b %e %H:%M:%S <BR /> MAX_TIMESTAMP_LOOKAHEAD = 15<BR /> </PRE><BR /> Time reported in Splunk - 11/17/13 12:48:36.000 AM</P> <P>I use "%e" because the day field is populated without leading zero's.</P> <P>What am I doing wrong?</P> Mon, 28 Sep 2020 15:18:14 GMT https://community.splunk.com/t5/Getting-Data-In/Time-Format-being-ignored-why/m-p/146346#M29794 tyronetv 2020-09-28T15:18:14Z https://community.splunk.com/t5/Getting-Data-In/Time-Format-being-ignored-why/m-p/146347#M29795 <P>1) Splunk is showing me the 'offset' time based upon my TZ setting.<BR /> 2) For some reason, for this source type ONLY, splunk is showing the AM/PM declaration. Not sure why.</P> Mon, 18 Nov 2013 15:44:50 GMT https://community.splunk.com/t5/Getting-Data-In/Time-Format-being-ignored-why/m-p/146347#M29795 tyronetv 2013-11-18T15:44:50Z