What would that number mean? Either use appropriate format like just %d to let splunk assume rest of the fields by default (I'm not too sure though that it will work good across month's end; I think you could be ingesting events with the wrong month) or ingest this field raw and then use INGEST_EVAL to calculate a resulting date. ... View more