Try this: TIME_PREFIX = \[ TIME_FORMAT = %m/%d/%y %H:%M:%S:%3N %Z MAX_TIMESTAMP_LOOKAHEAD = 25 Deploy to the first full instance of Splunk that handles the events (HF or Indexers), restart all splunk instances there, send in new events and only check those (old events will stay broken); use _index_earliest=-5m to be sure that you are looking at newly-indexed events. ... View more