Splunk Search

Extracting Date Fields


If I am doing custom field extraction on an event should I name the fields the same as the default day, month, year, time, etc or does is matter?

I hate to duplicate fields that splunk is already trying to extract or is there a way to disable the automatic date/time extraction for events? What is recommended?

Tags (3)
0 Karma

Re: Extracting Date Fields

Ultra Champion

You could just specify your custom time extraction in props.conf


Use the TIME_FORMAT property to specify a strptime pattern for your events.