I have events in plain text format like this: "[Process Id:3952 Thread Id: 4152] 03/10/2013 12:44:58 GetComponentDetailsFromXMLLookup - sXMLCategory = General" however, the event times are being indexed as: 10/03/2013 12:44:58.000 "[Process Id:3952 Thread Id: 4152] 03/10/2013 12:44:58 GetComponentDetailsFromXMLLookup - sXMLCategory = General" The fowarder is the Windows machine. The forwarder props.conf: [splunkd] EXTRACT-fields = (?i)^(?:[^ ]* ){2}(?:[+\-]\d+ )?(?P<log_level>[^ ]*)\s+(?P<component>[^ ]+) - (?P<message>.+) [splunk_web_service] EXTRACT-useragent = userAgent=(?P<browser>[^ (]+) [sourcetype:<mysourcetype>] MAX_TIMESTAMP_LOOKAHEAD = 19 TIME_FORMAT = %d/%m/%Y %H:%M:%S TIME_PREFIX = ] and the forwarder inputs.conf: [monitor://<mylogfilepath>] disabled = false host = <myhost> sourcetype = <mysourcetype> source = <mysource> index = <myindex> I have attempted to delete the local forwarder fishbucket directory and restart the forwarder to no avail. Is there some configuration missing? ... View more