Splunk Enterprise Security

Splunk time parse

Eyal
Path Finder

Hi, 

Splunk usually takes the log time event (_time) and parse it to:

date_hour, date_mday, date_minute, date_month, date_second, date_wday, date_year

Screenshot 2023-10-23 121840.png

 

I have found that some of our indexes does not contain this parse only the _time field.

What may cause this issue?

In addition, I am not sure but I have found something related to "DATETIME_CONFIG = /etc/datetime.xml" might be a good point not much on the internet that explain pretty well how to resolve this.

Would appreciate your help here 🙂

Tags (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

Adding to what has already been said - I would advise _against_ using those fields.

Their contents may be misleading, especially if you ingest data from different timezones and searching by them can be additionally skewed vs. what you expect if you're yet in another timezone.

Quoting the docs:

[...]

If an event has a date_* field, it represents the value of time/date directly from the event itself. If you have specified any timezone conversions or changed the value of the time/date at indexing or input time (for example, by setting the timestamp to be the time at index or input time), these fields will not represent that.

[...]

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Those fields are not present in every event.  See https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Usedefaultfields

---
If this reply helps you, Karma would be appreciated.
0 Karma

landen99
Motivator

If

ADD_EXTRA_TIME_FIELDS = true

then why wouldn't those fields be present in every event?

How could we ensure that those fields are present in every event?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

An event that does not have a timestamp will not have date_* fields.  That includes events where DATETIME_CONFIG=current or DATETIME_CONFIG=none.

---
If this reply helps you, Karma would be appreciated.
0 Karma

bowesmana
SplunkTrust
SplunkTrust

This is defined in props.conf for the sourcetype, see the 

ADD_EXTRA_TIME_FIELDS

setting in this documentation

https://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf#Timestamp_extraction_configurati...

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...