I have two types of logs that are formatted thusly:
hostname app->name: date time log data
hostname:date time log data
Very sporadically the log data portion of these logs may have a date in it (this is user inputted text) and Splunk pulls the date from the log data in these cases. It causes future dated events that seem like they would be easy to fix, but can't come up with the right props.conf stanza to fix.
a2-sb123 App->internal: 2011-12-13 15:23:24,556 INFO internal - Incoming Header: subject=FW:A Cool Night Out - Dec. 14, 2011
a2-sb123 App->internal: 2011-12-12 21:28:33,338 INFO internal - Incoming Header: subject=FW:December 14, 2011: This is the subject
a2-sb124:2011-12-12 20:50:12,950 INFO [UI] !!!!! username clicked on saveandnext for agent Dec 14 2011 in SLE
a2-sb124:2011-12-13 03:53:31,689 INFO UI [ID:wyetdTDrewWE1] - !!!!! username clicked on save for agent 14 Dec 2011 in SLE
Though the logs are dated correctly, Splunk dates the events for December 14th.
I've tried using this in props.conf, but it's not working, maybe it's the use of wildcard? Unfortunately host is the easiest spec to use to get to this data, as the sources and sourcetypes are varied for these servers.