Why is my timestamp date format changing from dd/mm/yyyy to mm/dd/yyyy?

[sebch]

Hi,

I'm using Splunk Enterprise 6.5.0 with Universal forwarders 6.5.0 for some years now to index log files from .Net webapp.

Forwarders are looking into a directory where each days a new file is created, with a name like webapp.%ddmmyyy%.log.

The log file content looks like that, no date information :

14:25:57.023 [9] DEBUG Log4NetManager - %Lots of Data%
14:25:58.383 [9] DEBUG Log4NetManager - % Data%

From the 1st of each month to the 12th, the data are classified in Splunk using a date format like mm/dd/yyyy. => Wrong
Then, from the 13th to the end of the month data are classified in this format dd/mm/yyyy. => Right

Example :
log files in date of the 12th of May 2016 is classified under the 5th of December 2016
log files in date of 13th of May 2016 is classified the right way

I can see that doing some searches within Splunk Web.

I never specified any date format in any .conf file in Splunk, and it always worked like charm.
Any idea about what am I missing?

Thanks in advance for your help!

[sebch · Accepted solution]

Think I've found my answer.

I had to configure a new source type (clone of log4j), modified the Timestamp from "Auto" to "Current time" and set sourcetype parameter on Forwarders input.conf files to my cloned log4j source type.

That's it.

[richgalloway]

If that does in fact solve your problem then please Accept your answer to help others find it in the future.