Splunk Search

Extracting Date Fields

sseekamp
Explorer

If I am doing custom field extraction on an event should I name the fields the same as the default day, month, year, time, etc or does is matter?

I hate to duplicate fields that splunk is already trying to extract or is there a way to disable the automatic date/time extraction for events? What is recommended?

Tags (3)
0 Karma

Damien_Dallimor
Ultra Champion

You could just specify your custom time extraction in props.conf

http://docs.splunk.com/Documentation/Splunk/latest/admin/propsconf

Use the TIME_FORMAT property to specify a strptime pattern for your events.

Get Updates on the Splunk Community!

Continuing Innovation & New Integrations Unlock Full Stack Observability For Your ...

You’ve probably heard the latest about AppDynamics joining the Splunk Observability portfolio, deepening our ...

Monitoring Amazon Elastic Kubernetes Service (EKS)

As we’ve seen, integrating Kubernetes environments with Splunk Observability Cloud is a quick and easy way to ...

Cloud Platform & Enterprise: Classic Dashboard Export Feature Deprecation

As of Splunk Cloud Platform 9.3.2408 and Splunk Enterprise 9.4, classic dashboard export features are now ...