setting the default date format for events

[las]

I have a date in my input files 08-11-12, This date could be August 11. 2012, or (as is the case) November 8. 2012, as I use European date-format.

It looks like Splunk likes to use the American date-format before using the European, so it thinks the event was written in august.

How do I change the default behavior, so that it first uses European format, and then American?

Kind regards

[las · Accepted solution]

I used the comment from dart.
A little more work, but it works.

[las]

Thanks - as usual very helpful info.

[dart]

It's better to do this with a TIME_FORMAT for each sourcetype, but otherwise you could create your own datetime.xml and then use the default stanza to specify using your copy of datetime.xml.

[Ayn]

These issues are typically found on a per-sourcetype basis, so setting a global default is kind of dangerous. But, if you really know what you are doing you could set a global setting using the [default] stanza in props.conf.

[las]

Yes, but isn't that on a sourcetype basis. I want to default use the European formats before the American.

[kristian_kolb]

Check out the TIME_FORMAT parameter for props.conf. With that you specify how the incoming timestamps should be parsed.