collect command and time

[bowesmana]

I have two Splunk servers and run the following command

| makeresults
| fields - _time
| collect index=temp addtime=f

In this , _time variable then comes in the indexed data as 2020-10-01 HH:MM:SS as expected. _time is taken from the info_search_time field, which is UTC

However, if I do this

| makeresults
| collect index=temp addtime=t

Then the raw event data looks like this in BOTH servers

10/01/2020 HH:MM:SS .....

i.e. MM/DD/YYYY

but in one server the ingested event is dated 2020-10-01, so parsing correctly as MM/DD/YYYY and in the other, the event is dated 2020-01-10, which is parsing the data as DD/MM/YYYY, which is not correct.

I don't believe the collect command provides control to format the added raw time field formatted as ISO8601, if it does, how? But can anyone say what controls the parsing format used to ingest this collected data?

[thambisetty]

what is  SPlunk versions in both instances?

[bowesmana]

Good question - the one parsing correctly is 8.0.1 and the one not is 7.3.4