Hello community, I need help with configuring Splunk to correctly process timestamp information in my UDP messages. When I send messages starting with a pattern like <\d+>, for example:   <777> 2025-01-03T06:12:19.236514-08:00 hello world   Splunk substitutes the original timestamp with the current date and local host address. Consequently, what I see in Splunk is:   Jan 28 14:27:25 127.0.0.1 2025-01-03T06:12:19.236514-08:00 hello world   I would like to know how to disable this behavior so that the actual timestamp from the message is preserved in the event. I have attempted to configure TIME_FORMAT and TIME_PREFIX in the props.conf file, but it seems those settings are applied after Splunk substitutes the timestamp with the current date and local host. As a workaround, I implemented the following in props.conf:   [my_sourcetype] EXTRACT-HostName = \b(?P\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d+(-\d{2}:\d{2})?) EVAL-_time = strptime(extracted_time, "%Y-%m-%dT%H:%M:%S.%6N%z")   Is there a better way to achieve this? Any guidance would be greatly appreciated! Thank you! ... View more