Few Events indexing with wrong time stamp

[rangineniarunku]

I can see that few events for some of the sources are indexing with wrong timestamp(both month and date are swapping), what I mean is events of Jul7th are indexing into Feb 2nd and happens only for few days and again sets back to correct time stamp and vice versa.

Is there any chance we can fix it and get the wrongly indexed events into correct timestamp back again.

My events and props.conf(at indexer) is as follows.

02/07/2017 09:14:40 |....|........

[sourcetype]
disabled=false
TIME_FORMAT=%d/%m/%Y %H:%M:%S

Can anyone help me with this?

[woodcock]

This happens when you do not tell splunk everything about your timestamps and you allow it to try to figure it out automatically. You must, at a minimum, use TIME_FORMAT (so you are on the right track). You need to deploy this to your indexers and restart all splunk instances there. Even so, only events that are indexed after the change will be effected: old broken events will stay broken.