A Splunk logging issue has been traced down to the timestamp format difference in two different DLP logs.
Namely, the RequestProcessor.log and the Smtp_operational log.
Is it possible to have both logs use the same timestamp formatting?
Formatting for Smtp_operational log is "two-digit day/three-character month/two-digit year".
Example: 02/Dec/24
Formatting for RequestProcessor.log is "three-character month space two-digit day comma space four-digit year".
Example: Dec 2, 2024
Engineering has confirmed that these is no way to modify the date/time stamp in our logs.
The Splunk team will need to create a separate parsing rule for each log file to accommodate the formatting difference.