Hi,
I'm using Splunk Enterprise 6.5.0 with Universal forwarders 6.5.0 for some years now to index log files from .Net webapp.
Forwarders are looking into a directory where each days a new file is created, with a name like `webapp.%ddmmyyy%.log`.
The log file content looks like that, no date information :
14:25:57.023 [9] DEBUG Log4NetManager - %Lots of Data%
14:25:58.383 [9] DEBUG Log4NetManager - % Data%
From the 1st of each month to the 12th, the data are classified in Splunk using a date format like mm/dd/yyyy. => Wrong
Then, from the 13th to the end of the month data are classified in this format dd/mm/yyyy. => Right
Example :
log files in date of the 12th of May 2016 is classified under the 5th of December 2016
log files in date of 13th of May 2016 is classified the right way
I can see that doing some searches within Splunk Web.
I never specified any date format in any .conf file in Splunk, and it always worked like charm.
Any idea about what am I missing?
Thanks in advance for your help!
↧