https://community.splunk.com/t5/Getting-Data-In/Splunk-indexing-data-incorrect/m-p/427727#M74937 <P>You need to specify the <CODE>TIME_FORMAT</CODE> attribute for that sourcetype in props.conf. In fact, it's a Best Practice to specify <CODE>TIME_FORMAT</CODE> for <EM>all</EM> sourcetypes to prevent this type of problem.<BR /> The data already indexed cannot be changed.</P> Fri, 26 Apr 2019 18:29:24 GMT richgalloway 2019-04-26T18:29:24Z https://community.splunk.com/t5/Getting-Data-In/Splunk-indexing-data-incorrect/m-p/427726#M74936 <P>I'm having trouble indexing my logs.<BR /> After investigations, I noticed that the splunk started indexing the data with the wrong date. Our log has the format dd /mm/yy, while splunk since last week began interpreting the dates as mm yy/dd, playing data from 04/18/19 to 04/19/18 - April 19, 2018 .<BR /> How can I fix this?</P> Fri, 26 Apr 2019 16:19:49 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-indexing-data-incorrect/m-p/427726#M74936 LeandroKopke 2019-04-26T16:19:49Z https://community.splunk.com/t5/Getting-Data-In/Splunk-indexing-data-incorrect/m-p/427727#M74937 <P>You need to specify the <CODE>TIME_FORMAT</CODE> attribute for that sourcetype in props.conf. In fact, it's a Best Practice to specify <CODE>TIME_FORMAT</CODE> for <EM>all</EM> sourcetypes to prevent this type of problem.<BR /> The data already indexed cannot be changed.</P> Fri, 26 Apr 2019 18:29:24 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-indexing-data-incorrect/m-p/427727#M74937 richgalloway 2019-04-26T18:29:24Z