Monitor Windows data with PowerShell scripts - Splunk Documentation   Here is the update link to docs. ... View more

Try renaming your SplunkTime variable to _time in PowerShell and see if that works. Splunk should pick up the time automatically, but what I can see from your output is that there are multiple times being returned, and that might lead to confusions. That's the reason you need a props.conf stanza for your sourcetype where you specify things like your time format, prefix, lookahead, etc. Take a look at this: http://docs.splunk.com/Documentation/Splunk/latest/Data/Configuretimestamprecognition ... View more

I fixed it by creating a custom datetime.xml in the end 🙂 ... View more