I believe I do need to process the timezone information in each individual log message because different messages may come from different timezones (GMT -5, GMT +1, GMT +10, etc). Is there a way in Splunk to parse it? Alternatively, going back to a solution using DATETIME_CONFIG = NONE, I would somehow need to tell Splunk to take a file modification date, but without the timezone information - perhaps your suggestion, TZ = YourTZ, would work here. Regarding %n formatter, I used it to represent a white space. I followed the Unix strptime specification on http://pubs.opengroup.org/onlinepubs/009695399/functions/strptime.html linked from http://docs.splunk.com/Documentation/Splunk/latest/Data/Configuretimestamprecognition. Perhaps your link (a Python specification) should be there instead. Many thanks. ... View more

Sorry, here is the strptime format that I used: %Y-%m-%d%n%H:%M:%S,%3N%n\(%Z\) and the timestamp prefix: ^xxx\|x\.xx\.x\.xx\|xxxxxxx\|xxx\\xxxx\| ... View more

I tried DATETIME_CONFIG = NONE in the config file, but the result was the same as before. I believe Splunk did use file modification date/time but it probably also picked up the timezone information and applied the normalization, resulting in some timestamps being in the future. I then tried to use the data input preview function and tell Splunk my date/time format but Splunk could not recognize it ("Could not use strptime to parse timestamp"). Here is my generic log file entry: xxx|x.xx.x.xx|xxxxxxx|xxx\xxxx|2012-07-18 10:11:24,856 (GMT+5)|ERROR|x|xxx.xx.xxx.xxx.xxx:x|xx:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx I entered the following timestamp format for strtime: %Y-%m-%d%n%H:%M:%S,%3N%n(%Z) I also specified the timestamp prefix pattern: ^xxx|x.xx.x.xx|xxxxxxx|xxx\xxxx| ... View more