From Splunk docs for %X: The time in the format for the current locale. For US English the format for 9:30 AM is 9:30:00.
From Splunk docs for %c: The date and time in the current locale's format **as defined by the server's operating system**. For example, Mon Jul 13 09:30:00 2015 for US English on Linux.
**Question -- is %X as defined by the Splunk server's operating system OR the locale of the browser viewing the page?**
↧