https://community.splunk.com/t5/Getting-Data-In/Few-Events-indexing-with-wrong-time-stamp/m-p/305411#M57631 <P>This happens when you do not tell splunk everything about your timestamps and you allow it to try to figure it out automatically. You must, at a minimum, use <CODE>TIME_FORMAT</CODE> (so you are on the right track). You need to deploy this to your indexers and restart all splunk instances there. Even so, only events that are indexed after the change will be effected: old broken events will stay broken.</P> Thu, 13 Jul 2017 01:52:59 GMT woodcock 2017-07-13T01:52:59Z https://community.splunk.com/t5/Getting-Data-In/Few-Events-indexing-with-wrong-time-stamp/m-p/305410#M57630 <P>I can see that few events for some of the sources are indexing with wrong timestamp(both month and date are swapping), what I mean is events of Jul7th are indexing into Feb 2nd and happens only for few days and again sets back to correct time stamp and vice versa.</P> <P>Is there any chance we can fix it and get the wrongly indexed events into correct timestamp back again.</P> <P>My events and props.conf(at indexer) is as follows.</P> <P>02/07/2017 09:14:40 |....|........</P> <P>[sourcetype]<BR /> disabled=false<BR /> TIME_FORMAT=%d/%m/%Y %H:%M:%S</P> <P>Can anyone help me with this?</P> Thu, 13 Jul 2017 01:37:15 GMT https://community.splunk.com/t5/Getting-Data-In/Few-Events-indexing-with-wrong-time-stamp/m-p/305410#M57630 rangineniarunku 2017-07-13T01:37:15Z https://community.splunk.com/t5/Getting-Data-In/Few-Events-indexing-with-wrong-time-stamp/m-p/305411#M57631 <P>This happens when you do not tell splunk everything about your timestamps and you allow it to try to figure it out automatically. You must, at a minimum, use <CODE>TIME_FORMAT</CODE> (so you are on the right track). You need to deploy this to your indexers and restart all splunk instances there. Even so, only events that are indexed after the change will be effected: old broken events will stay broken.</P> Thu, 13 Jul 2017 01:52:59 GMT https://community.splunk.com/t5/Getting-Data-In/Few-Events-indexing-with-wrong-time-stamp/m-p/305411#M57631 woodcock 2017-07-13T01:52:59Z