Best timestamp format

[splunkreal]

Hello guys,
could you confirm Splunk handles best US format (MM/DD/YYYY or YYYY/MM/DD for instance) where month preceding day?

Thanks.

[richgalloway · Accepted solution]

Splunk handles US date formats best, particularly mm/dd/yyyy over dd/mm/yyyy. That said, the date format doesn't matter if you specify TIME_FORMAT in your props.conf file (which you should do always).