All right, there seems to be something wrong with how Splunk parses the timestamp. I think you need to explicitly configure how this is parsed - through the following config parameters in props.conf ;
TIME_PREFIX
TIME_FORMAT
MAX_TIMESTAMP_LOOKAHEAD
http://docs.splunk.com/Documentation/Splunk/5.0.2/Admin/Propsconf
For TIME_FORMAT it will be good to know how to specify the strptime variables, see http://www.strftime.net
I believe that your props.conf should look something like;
[your sourcetype]
MAX_TIMESTAMP_LOOKAHEAD = 50
TIME_PREFIX = \[
TIME_FORMAT = %d/%b/%Y:%H:%M:%S %z
the rest of your props parameters here
These settings should go into a props.conf file on the indexer (or the heavy forwarder if you use that).
Hope this helps,
Kristian
... View more
