https://community.splunk.com/t5/Getting-Data-In/Failed-to-parse-epoch-timestamp-for-Checkpoint-Opsec/m-p/175891#M98304 <P>Splunk isn’t recognizing the date from the opsec.logs since the date is being sent in a localized format</P> Thu, 08 Jan 2015 13:49:16 GMT rsimmons 2015-01-08T13:49:16Z https://community.splunk.com/t5/Getting-Data-In/Failed-to-parse-epoch-timestamp-for-Checkpoint-Opsec/m-p/175891#M98304 <P>Splunk isn’t recognizing the date from the opsec.logs since the date is being sent in a localized format</P> Thu, 08 Jan 2015 13:49:16 GMT https://community.splunk.com/t5/Getting-Data-In/Failed-to-parse-epoch-timestamp-for-Checkpoint-Opsec/m-p/175891#M98304 rsimmons 2015-01-08T13:49:16Z https://community.splunk.com/t5/Getting-Data-In/Failed-to-parse-epoch-timestamp-for-Checkpoint-Opsec/m-p/175892#M98305 <P>This can be resolve by modifying DATESTAMP = epoch (“unix”) and by doing this don't need to set TZs. You will need to edit DATESTAMP properties under fw1-loggrabber.conf file so that it is indexed properly.</P> Thu, 08 Jan 2015 13:49:41 GMT https://community.splunk.com/t5/Getting-Data-In/Failed-to-parse-epoch-timestamp-for-Checkpoint-Opsec/m-p/175892#M98305 rsimmons 2015-01-08T13:49:41Z