Time config incorrect

[_joe]

This isn't so much a question as a comment. I found that time config to be incorrect. 

My logs start like this:
{"Time": "29 Jan 2025 03:16:30, PST",

The default timestring is expecting a 2 digit year.

%d %b %y %H:%M:%S, %Z

Prior to the update, Splunk was stil able to figure out the time but issed the timezone parameter. In other words, if your heavy forwarder has the same timezone as your zScaler logs you would probably be fine.

[_joe · Accepted solution]

I updated it to a 4 digit year to match my logs. 

%d %b %Y %H:%M:%S, %Z