https://community.splunk.com/t5/Getting-Data-In/How-do-i-get-splunk-to-handle-the-year-in-timestamps-dated/m-p/50171#M9538 <P>Yes, your dates are being restricted by the default <CODE>MAX_DAYS_AGO</CODE> setting in props.conf. The default is 2000 (days), which currently puts the limit at September of 2005.</P> Fri, 25 Feb 2011 09:14:42 GMT gkanapathy 2011-02-25T09:14:42Z https://community.splunk.com/t5/Getting-Data-In/How-do-i-get-splunk-to-handle-the-year-in-timestamps-dated/m-p/50170#M9537 <P>No matter what format I attempt to force upon historical timestamps:</P> <P>either</P> <P>Feb 11, 2004 01:23:45</P> <P>or</P> <P>2004-02-11 01:23:45</P> <P>splunk ignores years that fall before 2006 while the rest of the timestamp is preserved. The current year (2011) is substituted for years &lt;= 2006. </P> <P>Is this a configurable parameter/range I'm missing?</P> Fri, 25 Feb 2011 08:43:30 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-i-get-splunk-to-handle-the-year-in-timestamps-dated/m-p/50170#M9537 tylr 2011-02-25T08:43:30Z https://community.splunk.com/t5/Getting-Data-In/How-do-i-get-splunk-to-handle-the-year-in-timestamps-dated/m-p/50171#M9538 <P>Yes, your dates are being restricted by the default <CODE>MAX_DAYS_AGO</CODE> setting in props.conf. The default is 2000 (days), which currently puts the limit at September of 2005.</P> Fri, 25 Feb 2011 09:14:42 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-i-get-splunk-to-handle-the-year-in-timestamps-dated/m-p/50171#M9538 gkanapathy 2011-02-25T09:14:42Z