timestamp not being handled properly

[a212830]

Hi,

I'm having issues getting Splunk to properly recognize the date on some logfiles. The input is pretty simple:

10-Dec-12 12:28:36 ELEMENT=ABCDEF METRIC=Average_CPU_Utilization METRIC_VALUE=37.00000000 DURATION=303
10-Dec-12 12:33:39 ELEMENT=ABCDEF METRIC=Average_CPU_Utilization METRIC_VALUE=52.00000000 DURATION=300
10-Dec-12 12:38:39 ELEMENT=ABCDEF METRIC=Average_CPU_Utilization METRIC_VALUE=55.00000000 DURATION=299
10-Dec-12 12:43:38 ELEMENT=ABCDEF METRIC=Average_CPU_Utilization METRIC_VALUE=38.00000000 DURATION=302

My props file has the following:

[snmpinfo]
MAX_TIMESTAMP_LOOKAHEAD = 35
NO_BINARY_CHECK = 1
SHOULD_LINEMERGE = false
TIME_FORMAT = %d-%b-%y %H:%M:%S
TIME_PREFIX = ^

The time is getting picked up properly, but the date is coming in as 12/12/10. What am I doing wrong? I looked at the strptime, and it looks correct to me. This data is coming in from a heavy-forwarder to an indexer.

[sowings]

If the data is being picked up from a heavy forwarder (read: event aware) it's doing the parsing of time stamps; you'll want to ship the same bit of configuration over to the heavy as well.

[a212830]

That's where I have the props.conf - on the forwarder. Should I put it on the indexer as well? If yes, why?