https://community.splunk.com/t5/Getting-Data-In/Best-timestamp-format/m-p/462510#M79815 <P>Splunk handles US date formats best, particularly <CODE>mm/dd/yyyy</CODE> over <CODE>dd/mm/yyyy</CODE>. That said, the date format doesn't matter if you specify <CODE>TIME_FORMAT</CODE> in your props.conf file (which you should do always).</P> Mon, 16 Dec 2019 13:12:37 GMT richgalloway 2019-12-16T13:12:37Z https://community.splunk.com/t5/Getting-Data-In/Best-timestamp-format/m-p/462509#M79814 <P>Hello guys,<BR /> could you confirm Splunk handles best US format (MM/DD/YYYY or YYYY/MM/DD for instance) where month preceding day?</P> <P>Thanks.</P> Mon, 16 Dec 2019 12:47:45 GMT https://community.splunk.com/t5/Getting-Data-In/Best-timestamp-format/m-p/462509#M79814 splunkreal 2019-12-16T12:47:45Z https://community.splunk.com/t5/Getting-Data-In/Best-timestamp-format/m-p/462510#M79815 <P>Splunk handles US date formats best, particularly <CODE>mm/dd/yyyy</CODE> over <CODE>dd/mm/yyyy</CODE>. That said, the date format doesn't matter if you specify <CODE>TIME_FORMAT</CODE> in your props.conf file (which you should do always).</P> Mon, 16 Dec 2019 13:12:37 GMT https://community.splunk.com/t5/Getting-Data-In/Best-timestamp-format/m-p/462510#M79815 richgalloway 2019-12-16T13:12:37Z