timestamp format of the input files

[newbiesplunk]

Hi,
when i forward my input files (c:\data) from server A to Splunk Head at ServerB, the date format was correct for all input files as of yesterday. But today, when the date is 1/8/2014 (dd/mm/yyyy), some files from the server A is recognised as 8/1/2014 (dd/mm/yyyy) and some recognised as 1/8/2014 (dd/mm/yyyy). Why is it so? How and where to correct it to ensure the new data format is recognised as dd/mm/yyyy. thks

[keerthana_k]

You can do this my mentioning your time format in props.conf file:

Under your configuration stanza, you can add

TIME_FORMAT=%d/%m/%Y

This will ensure that the timestamp for all the events of that type are considered in dd/mm/yyyy format.

[somesoni2]

You might have to configure other attributes for your sourcetype for timestamp recognition and event-breaking. Please provide some sample logs and current sourcetype definition from props.conf (if any, from indexer).

[keerthana_k]

Can you paste your props.conf setting?

[newbiesplunk]

how come from the same forwarder, the date format is different for different input files? So strange.

[newbiesplunk]

it works only the first event after restarted the splunk and the subsequent events were returned back to mm/dd/yyyy. ANy thing else need to do? thks

[strive]

Can you post your props.conf settings