https://community.splunk.com/t5/Getting-Data-In/Time-stamp-parsing-not-seeming-to-work/m-p/31499#M5543 <P>Ok, answered this one myself... need to delete and re-index to force recognition</P> Thu, 08 Dec 2011 17:03:37 GMT esi_splunk 2011-12-08T17:03:37Z https://community.splunk.com/t5/Getting-Data-In/Time-stamp-parsing-not-seeming-to-work/m-p/31498#M5542 <P>Using Splunk 4.2.4 on Windows XP<BR /><BR /> I am a newbie trying to parse my FTP logs that have time stamps that look like<BR /><BR /> 04Dec11 23:54:29<BR /><BR /> So based on help from searching this great community resource, I edited F:\Program Files\Splunk\etc\users\admin\search\local\props.conf to contain<BR /><BR /> [source::F:\Shared\FTP\Log Files\*.txt]<BR /><BR /> TIME_FORMAT = %d%b%y %H:%M:%S</P> <P>And restarted Splunk, (Note that I do have double back-slash in the path name but Markdown is removing them) but the parsing is still not appearing to get the correct date/time. How do I debug this?</P> Thu, 08 Dec 2011 16:23:47 GMT https://community.splunk.com/t5/Getting-Data-In/Time-stamp-parsing-not-seeming-to-work/m-p/31498#M5542 esi_splunk 2011-12-08T16:23:47Z https://community.splunk.com/t5/Getting-Data-In/Time-stamp-parsing-not-seeming-to-work/m-p/31499#M5543 <P>Ok, answered this one myself... need to delete and re-index to force recognition</P> Thu, 08 Dec 2011 17:03:37 GMT https://community.splunk.com/t5/Getting-Data-In/Time-stamp-parsing-not-seeming-to-work/m-p/31499#M5543 esi_splunk 2011-12-08T17:03:37Z