How to understand "Splunk software can extract only dates from a source, not times. If you need to extract a time from a source, use a transform." "

[jimmyzhangau]

The note is here,
http://docs.splunk.com/Documentation/Splunk/6.6.0/Data/HowSplunkextractstimestamps
But I have a problem to understand this,
In the example below in that page, you can see props.conf can extract both date and time without transforms.conf

Another example that includes time zone information:

…Valid_Until=Thu Dec 31 17:59:59 GMT-06:00 2020

To extract the timestamp, add this to props.conf:

[host::bar]
TIME_PREFIX = Valid_Until=
TIME_FORMAT = %a %b %d %H:%M:%S %Z%z %Y

[richgalloway]

In the text you quoted, "source" means "file name". Splunk prefers to get timestamps from events, but if it can't do that it will try to get it from other places. One of those places is the name of the source file - like a log file named .../20170515/error.log.

Your example data contains a full timestamp that Splunk should have no trouble parsing with the TIME_FORMAT string, which you appear to have.

What problem are you having with timestamps?

[jimmyzhangau]

From this example you can see Splunk can extract both date and time by using props.conf, but why in the note, it said :"Splunk software can extract only dates from a source, not times. If you need to extract a time from a source, use a transform." Also, I don't think here 'source' means 'filename', it should mean all types of data sources.

[richgalloway]

In this instance, "source" does not mean all types of data source, but I understand the confusion. I suggest you submit a comment on that documentation page so Splunk can clarify it.