Splunk Search

Extracting Date Fields

sseekamp
Explorer

If I am doing custom field extraction on an event should I name the fields the same as the default day, month, year, time, etc or does is matter?

I hate to duplicate fields that splunk is already trying to extract or is there a way to disable the automatic date/time extraction for events? What is recommended?

Tags (3)
0 Karma

Damien_Dallimor
Ultra Champion

You could just specify your custom time extraction in props.conf

http://docs.splunk.com/Documentation/Splunk/latest/admin/propsconf

Use the TIME_FORMAT property to specify a strptime pattern for your events.

Get Updates on the Splunk Community!

New Case Study Shows the Value of Partnering with Splunk Academic Alliance

The University of Nevada, Las Vegas (UNLV) is another premier research institution helping to shape the next ...

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...