date_* fields are NULL for some data. Why?

[the_wolverine]

I have a bunch of events that, for some reason, are coming up with NULL values for date_* fields. Why would this happen? The events all contain the correct date/time -- just missing the date_* fields that I wanted to use for reporting.

[sideview]

I think there was a previous question about this but I cant find it.

Somewhat from memory and somewhat from the implications in the link below, the date_* fields are only present when Splunk has extracted the date from the event text itself, and there hasnt been any custom timezone offset or anything applied.

So if you are just using the current time for instance (DATETIME_CONFIG=CURRENT), instead of having Splunk parse it out of the event, or if you are doing some timezone offset in inputs.conf, I think the date_* fields simply dissappear. Which would lead to them showing up in reports as NULL.

http://www.splunk.com/base/Documentation/4.2/User/UseDefaultAndInternalFields

[gkanapathy]

And I think this is considered a bug