I have two Splunk servers and run the following command
| makeresults
| fields - _time
| collect index=temp addtime=f
In this , _time variable then comes in the indexed data as 2020-10-01 HH:MM:SS as expected. _time is taken from the info_search_time field, which is UTC
However, if I do this
| makeresults
| collect index=temp addtime=t
Then the raw event data looks like this in BOTH servers
10/01/2020 HH:MM:SS .....
i.e. MM/DD/YYYY
but in one server the ingested event is dated 2020-10-01, so parsing correctly as MM/DD/YYYY and in the other, the event is dated 2020-01-10, which is parsing the data as DD/MM/YYYY, which is not correct.
I don't believe the collect command provides control to format the added raw time field formatted as ISO8601, if it does, how? But can anyone say what controls the parsing format used to ingest this collected data?
