https://community.splunk.com/t5/Splunk-Search/collect-command-and-time/m-p/522407#M147307 <P>I have two Splunk servers and run the following command</P><LI-CODE lang="markup">| makeresults | fields - _time | collect index=temp addtime=f</LI-CODE><P>&nbsp;</P><P>In this , _time variable then comes in the indexed data as 2020-10-01 HH:MM:SS as expected. _time is taken from the info_search_time field, which is UTC</P><P>However, if I do this</P><P>&nbsp;</P><LI-CODE lang="markup">| makeresults | collect index=temp addtime=t</LI-CODE><P>&nbsp;</P><P>Then the raw event data looks like this in BOTH servers</P><P>10/01/2020 HH:MM:SS .....</P><P>i.e. MM/DD/YYYY</P><P>but in one server the ingested event is dated&nbsp;2020-10-01, so parsing correctly as MM/DD/YYYY and in the other, the event is dated 2020-01-10, which is parsing the data as DD/MM/YYYY, which is not correct.</P><P>I don't believe the collect command provides control to format the added raw time field formatted as ISO8601, if it does, how? But can anyone say what controls the parsing format used to ingest this collected data?</P><P>&nbsp;</P> Thu, 01 Oct 2020 06:25:47 GMT bowesmana 2020-10-01T06:25:47Z https://community.splunk.com/t5/Splunk-Search/collect-command-and-time/m-p/522407#M147307 <P>I have two Splunk servers and run the following command</P><LI-CODE lang="markup">| makeresults | fields - _time | collect index=temp addtime=f</LI-CODE><P>&nbsp;</P><P>In this , _time variable then comes in the indexed data as 2020-10-01 HH:MM:SS as expected. _time is taken from the info_search_time field, which is UTC</P><P>However, if I do this</P><P>&nbsp;</P><LI-CODE lang="markup">| makeresults | collect index=temp addtime=t</LI-CODE><P>&nbsp;</P><P>Then the raw event data looks like this in BOTH servers</P><P>10/01/2020 HH:MM:SS .....</P><P>i.e. MM/DD/YYYY</P><P>but in one server the ingested event is dated&nbsp;2020-10-01, so parsing correctly as MM/DD/YYYY and in the other, the event is dated 2020-01-10, which is parsing the data as DD/MM/YYYY, which is not correct.</P><P>I don't believe the collect command provides control to format the added raw time field formatted as ISO8601, if it does, how? But can anyone say what controls the parsing format used to ingest this collected data?</P><P>&nbsp;</P> Thu, 01 Oct 2020 06:25:47 GMT https://community.splunk.com/t5/Splunk-Search/collect-command-and-time/m-p/522407#M147307 bowesmana 2020-10-01T06:25:47Z https://community.splunk.com/t5/Splunk-Search/collect-command-and-time/m-p/522455#M147315 <P>what is&nbsp; SPlunk versions in both instances?</P> Thu, 01 Oct 2020 10:48:37 GMT https://community.splunk.com/t5/Splunk-Search/collect-command-and-time/m-p/522455#M147315 thambisetty 2020-10-01T10:48:37Z https://community.splunk.com/t5/Splunk-Search/collect-command-and-time/m-p/522595#M147358 <P>Good question - the one parsing correctly is 8.0.1 and the one not is 7.3.4</P><P>&nbsp;</P> Thu, 01 Oct 2020 21:14:04 GMT https://community.splunk.com/t5/Splunk-Search/collect-command-and-time/m-p/522595#M147358 bowesmana 2020-10-01T21:14:04Z