I have logs in my file
01-03-2018 15:54:58 WARNING [PID:88888][TradeId:11551427] /apps/abcrc/src/check/src/mx_rtpr.cpp:1146 - Sanity Check Exception void sanity_check(void*, rtPRICING_API_LIBRARY*)@/apps/abcrc/Flex/src/mx_rtpr.cpp:1034:End date not equal to option expiry date
that log is of 1st march 2018 but splunk has taken it as a log of 3 January 2018 , please suggest how to manipulate _time field so that my new data or existing data will come in proper time format .
It would also be good to specify
MAX_TIMESTAMP_LOOKAHEAD so splunk knows where the timestamp is located
[sourcetype_name] TIME_PREFIX = ^ TIME_FORMAT = %d-%m-%Y %H:%M:%S MAX_TIMESTAMP_LOOKAHEAD = 20