Reporting

date_* fields are NULL for some data. Why?

the_wolverine
Champion

I have a bunch of events that, for some reason, are coming up with NULL values for date_* fields. Why would this happen? The events all contain the correct date/time -- just missing the date_* fields that I wanted to use for reporting.

sideview
SplunkTrust
SplunkTrust

I think there was a previous question about this but I cant find it.

Somewhat from memory and somewhat from the implications in the link below, the date_* fields are only present when Splunk has extracted the date from the event text itself, and there hasnt been any custom timezone offset or anything applied.

So if you are just using the current time for instance (DATETIME_CONFIG=CURRENT), instead of having Splunk parse it out of the event, or if you are doing some timezone offset in inputs.conf, I think the date_* fields simply dissappear. Which would lead to them showing up in reports as NULL.

http://www.splunk.com/base/Documentation/4.2/User/UseDefaultAndInternalFields

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

And I think this is considered a bug

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) v3.54.0

The Splunk Threat Research Team (STRT) recently released Enterprise Security Content Update (ESCU) v3.54.0 and ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...