Extracting Date Fields

[sseekamp]

If I am doing custom field extraction on an event should I name the fields the same as the default day, month, year, time, etc or does is matter?

I hate to duplicate fields that splunk is already trying to extract or is there a way to disable the automatic date/time extraction for events? What is recommended?

[Damien_Dallimor]

You could just specify your custom time extraction in props.conf

http://docs.splunk.com/Documentation/Splunk/latest/admin/propsconf

Use the TIME_FORMAT property to specify a strptime pattern for your events.