topic Why are date_ fields missing? in Splunk Search

Why are date_ fields missing?

mykol_j — Wed, 20 Jul 2022 19:18:09 GMT

What happened to the date_wday, date_hour, and the others? Am I going nuts, waking from a dream where they used to be there all the _time?

looks like date_mday and date_month are still there...

on 8.2.6

Re: date_ fields are missing...? Am I crazy?

mykol_j — Tue, 19 Jul 2022 20:44:37 GMT

Hmm, appears to be based on the index... I don't remember this being an issue -- as far as I remember, they've always been there along with _time. Anyone have any insight?

Re: date_ fields are missing...? Am I crazy?

inventsekar — Tue, 19 Jul 2022 20:48:32 GMT

hmm, you should provide us some "more" details...

1. what version of Splunk you are using - free splunk or enterprise or cloud?

2. on which index you saw this above issue?

3. the SPL search query you use for this above issue?

if you are not going nuts and if you use older versions of splunk, splunk will make you go nuts automatically. (for example, the license consumption calculation has changed "drastically" on each versions of 6x, 7x, 8x, etc)

Re: date_ fields are missing...? Am I crazy?

mykol_j — Wed, 20 Jul 2022 18:03:43 GMT

Enterprise 8.2.6

The SPL is at it's most basic:

index=badging -- yes, it's door badging data. Yes, the timestamps are standard and are being read correctly.

I noticed that if I specify the servername the data's coming from (i.e. host=badgingserver) the fields appear (date_hour, date_minute, date_year, etc.). But those are coming from the index the server is sending it's default information to (/var/log/) -- in this case "security" before you ask. But a simple "index=badging" or a simple "index=badging host=badgingserver" -- which is a single file in /var/log/badging/badge.log -- and the fields not being there.

I wasn't aware of the index impacting whether a "default" field like date_year would appear...

Re: date_ fields are missing...? Am I crazy?

mykol_j — Wed, 20 Jul 2022 18:14:39 GMT

Think I just noticed part of the problem, maybe this post will still help somebody out there if they run across it (otherwise I'd delete it out of embarrassment, 😉

The data in question has a typo in the timestamp, a comma. Even though it's being extracted OK into "_time", it appears that it's enough to jack with the other "date_" extractions.

i.e.: 2022-07-20 13:07:51,352

Re: Why are date_ fields missing?

mykol_j — Tue, 26 Jul 2022 20:40:46 GMT

All turned out to be a timestamp extraction.

As soon as we removed DATETIME_CONFIG = NONE it fixed it. Go figure.