Splunk Search

Extracting Date Fields

sseekamp
Explorer

If I am doing custom field extraction on an event should I name the fields the same as the default day, month, year, time, etc or does is matter?

I hate to duplicate fields that splunk is already trying to extract or is there a way to disable the automatic date/time extraction for events? What is recommended?

Tags (3)
0 Karma

Damien_Dallimor
Ultra Champion

You could just specify your custom time extraction in props.conf

http://docs.splunk.com/Documentation/Splunk/latest/admin/propsconf

Use the TIME_FORMAT property to specify a strptime pattern for your events.

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...