topic Re: Why doesn't the time format match my log? in Getting Data In https://community.splunk.com/t5/Getting-Data-In/Why-doesn-t-the-time-format-match-my-log/m-p/433842#M75808 <P>That TIME_FORMAT does not match your log. Your log has <CODE>/</CODE> as separator, while your TIME_FORMAT uses <CODE>-</CODE>. Which will cause Splunk to revert to auto detection, which indeed can fail on ambiguous dates likes <CODE>01/06/2018</CODE>.</P> Tue, 29 Sep 2020 19:45:09 GMT FrankVl 2020-09-29T19:45:09Z Why doesn't the time format match my log? https://community.splunk.com/t5/Getting-Data-In/Why-doesn-t-the-time-format-match-my-log/m-p/433841#M75807 <P>Hi splunkers </P> <P>I have following log entry in file getting indexed on sourcetype name "ncm"</P> <PRE><CODE>"01/06/2018 12:00:47 : Started LoadBalancer" </CODE></PRE> <P>This is of 1st june 2018 but in splunk this entry has been taken as 6 january 2018 . Before this entry comes in the log two days ago i have already changed the time format in props.conf </P> <PRE><CODE>[ncm] TIME_FORMAT = %d-%m-%Y %H:%M:%S </CODE></PRE> <P>So in that two days data arrived as per my time format but today 1st june data went to 6th january .</P> <P>Please help.</P> Fri, 01 Jun 2018 11:37:48 GMT https://community.splunk.com/t5/Getting-Data-In/Why-doesn-t-the-time-format-match-my-log/m-p/433841#M75807 kannu 2018-06-01T11:37:48Z Re: Why doesn't the time format match my log? https://community.splunk.com/t5/Getting-Data-In/Why-doesn-t-the-time-format-match-my-log/m-p/433842#M75808 <P>That TIME_FORMAT does not match your log. Your log has <CODE>/</CODE> as separator, while your TIME_FORMAT uses <CODE>-</CODE>. Which will cause Splunk to revert to auto detection, which indeed can fail on ambiguous dates likes <CODE>01/06/2018</CODE>.</P> Tue, 29 Sep 2020 19:45:09 GMT https://community.splunk.com/t5/Getting-Data-In/Why-doesn-t-the-time-format-match-my-log/m-p/433842#M75808 FrankVl 2020-09-29T19:45:09Z Re: Why doesn't the time format match my log? https://community.splunk.com/t5/Getting-Data-In/Why-doesn-t-the-time-format-match-my-log/m-p/433843#M75809 <P>@FrankVl </P> <P>So below will work ?</P> <P>[ncm]<BR /> TIME_FORMAT = %d/%m/%Y %H:%M:%S</P> Fri, 01 Jun 2018 12:34:31 GMT https://community.splunk.com/t5/Getting-Data-In/Why-doesn-t-the-time-format-match-my-log/m-p/433843#M75809 kannu 2018-06-01T12:34:31Z Re: Why doesn't the time format match my log? https://community.splunk.com/t5/Getting-Data-In/Why-doesn-t-the-time-format-match-my-log/m-p/433844#M75810 <P>Yes, I would expect it would <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Fri, 01 Jun 2018 12:36:14 GMT https://community.splunk.com/t5/Getting-Data-In/Why-doesn-t-the-time-format-match-my-log/m-p/433844#M75810 FrankVl 2018-06-01T12:36:14Z