For some reason, Splunk has started to swap the date format for these servers The data is being imported, but it is going into splunk as the 11th September, rather than the 9th October.

numbpulse — Fri, 10 Nov 2017 07:30:07 GMT

For some reason, Splunk has started to swap the date format for these servers
The data is being imported, but it is going into splunk as the 11th September, rather than the 9th October.

This in turn is not giving me results of specific host set-up , rest from all hosts splunk is giving data.

Re: For some reason, Splunk has started to swap the date format for these servers The data is being imported, but it is going into splunk as the 11th September, rather than the 9th October.

richgalloway — Fri, 10 Nov 2017 13:59:40 GMT

It sounds like you are using the default TIME_FORMAT setting, which is the US format of mm/dd/yyyy. If you add TIME_FORMAT attributes for each sourcetype in your props.conf files on your indexers and heavy forwarders, Splunk should read dates correctly. The TIME_FORMAT values should match the way timestamps appear in your data. That's probably something like %d/%m/%Y %H:%M:%S. You will need to start Splunk after editing the props.conf files. Note that the change will only affect new data; data that is already indexed will not change (you may need to re-index it).

topic For some reason, Splunk has started to swap the date format for these servers The data is being imported, but it is going into splunk as the 11th September, rather than the 9th October. in Getting Data In

For some reason, Splunk has started to swap the date format for these servers The data is being imported, but it is going into splunk as the 11th September, rather than the 9th October.

Re: For some reason, Splunk has started to swap the date format for these servers The data is being imported, but it is going into splunk as the 11th September, rather than the 9th October.