Add Data Wizard FTW! [ tbourne ] SHOULD_LINEMERGE=false NO_BINARY_CHECK=true TIME_FORMAT=%d-%m-%Y %H:%M:%S,%f TIME_PREFIX=^ TZ=UTC MAX_TIMESTAMP_LOOKAHEAD=30 This should clean up your timestamping and get you some perf gains. Best practice is to set linebreaker and time formatting params explicitly on all sourcetypes, as making splunk auto discover makes it work harder and ensures you avoid this pain in the future. http://docs.splunk.com/Documentation/Splunk/6.5.0/Data/Configuretimestamprecognition ... View more