Reporting

date_* fields are NULL for some data. Why?

the_wolverine
Champion

I have a bunch of events that, for some reason, are coming up with NULL values for date_* fields. Why would this happen? The events all contain the correct date/time -- just missing the date_* fields that I wanted to use for reporting.

sideview
SplunkTrust
SplunkTrust

I think there was a previous question about this but I cant find it.

Somewhat from memory and somewhat from the implications in the link below, the date_* fields are only present when Splunk has extracted the date from the event text itself, and there hasnt been any custom timezone offset or anything applied.

So if you are just using the current time for instance (DATETIME_CONFIG=CURRENT), instead of having Splunk parse it out of the event, or if you are doing some timezone offset in inputs.conf, I think the date_* fields simply dissappear. Which would lead to them showing up in reports as NULL.

http://www.splunk.com/base/Documentation/4.2/User/UseDefaultAndInternalFields

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

And I think this is considered a bug

0 Karma
Get Updates on the Splunk Community!

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...