In DBConnect 2.0 when I created an input, it was created the fields like date_mday, date_month, date_week, etc..
Now I updated to the version 3.1.1 and it isn't creating this fields anymore. This a bug or something that I have to configure to fix it?
This appears to be a bug that was introduced in 3.0 and apparently has not been fixed yet.
Events indexed by DB Connect 3.0.0 do not include the automatic time fields date_hour, date_minute, date_year, date_month, and date_mday. Additionally, props.conf overrides cannot be used to alter the indexed time.
Workaround: Use calculated fields to extract those fields on search time:
1. In Splunk UI, go to Settings->Fields->Calculate fields->New
2. In the popup, we can configure based on sourcetype. For example, if we want to data_hour to be present, then we define the "Eval Expression" like: strftime(_time, "%H"), then give it a meaningful name.
3. Next time if we search against this sourcetype, fields will be added automatically.
I happened to see this in the release notes of an older version as I was scanning for changes before upgrading so I cannot vouch for the workaround or if it still applies in version 3.1.1. This was listed in the notes for version 3.0.3 here.