OK, that was a bit of a long shot since I've never done it myself but. 1) The time parsing comes as one of the first stages of event processing during ingestion 2) You can manipulate metadata with transforms 3) You can use ingest-time evals to modify values not only with simple regexes but also with quite a significant range of normal splunk operations. See the https://conf.splunk.com/files/2020/slides/PLA1154C.pdf for example. ... View more