Hi this will help.
docs.splunk.com/Documentation/Splunk/6.2.2/Data/Configuretimestamprecognition
To configure how Splunk Enterprise recognizes timestamps, edit
props.conf . There are a number of attributes that pertain to
timestamps. In particular, you can determine how Splunk Enterprise
recognizes a timestamp by using the TIME_FORMAT attribute to specify
a strptime() format for the timestamp. You can also set other
attributes pertaining to timestamps; for example, to specify where a
timestamp is located in an event, what time zone to use, or how to
deal with timestamps of varying currency.