topic Re: How to understand "Splunk software can extract only dates from a source, not times. If you need to extract a time from a source, use a transform." " in Getting Data In

How to understand "Splunk software can extract only dates from a source, not times. If you need to extract a time from a source, use a transform." "

jimmyzhangau — Tue, 29 Sep 2020 14:04:12 GMT

The note is here,
http://docs.splunk.com/Documentation/Splunk/6.6.0/Data/HowSplunkextractstimestamps
But I have a problem to understand this,
In the example below in that page, you can see props.conf can extract both date and time without transforms.conf

Another example that includes time zone information:

…Valid_Until=Thu Dec 31 17:59:59 GMT-06:00 2020

To extract the timestamp, add this to props.conf:

[host::bar]
TIME_PREFIX = Valid_Until=
TIME_FORMAT = %a %b %d %H:%M:%S %Z%z %Y

Re: How to understand "Splunk software can extract only dates from a source, not times. If you need to extract a time from a source, use a transform." "

richgalloway — Mon, 15 May 2017 13:38:57 GMT

In the text you quoted, "source" means "file name". Splunk prefers to get timestamps from events, but if it can't do that it will try to get it from other places. One of those places is the name of the source file - like a log file named .../20170515/error.log.

Your example data contains a full timestamp that Splunk should have no trouble parsing with the TIME_FORMAT string, which you appear to have.

What problem are you having with timestamps?

Re: How to understand "Splunk software can extract only dates from a source, not times. If you need to extract a time from a source, use a transform." "

jimmyzhangau — Tue, 16 May 2017 04:59:17 GMT

From this example you can see Splunk can extract both date and time by using props.conf, but why in the note, it said :"Splunk software can extract only dates from a source, not times. If you need to extract a time from a source, use a transform." Also, I don't think here 'source' means 'filename', it should mean all types of data sources.

Re: How to understand "Splunk software can extract only dates from a source, not times. If you need to extract a time from a source, use a transform." "

richgalloway — Tue, 16 May 2017 21:44:36 GMT

In this instance, "source" does not mean all types of data source, but I understand the confusion. I suggest you submit a comment on that documentation page so Splunk can clarify it.