Time is an important and confusing topic in Splunk. If you want to skip this section, absorb one concept: time must be parsed properly on the way into the index, as it cannot be changed later without indexing the raw data again.
