If I am doing custom field extraction on an event should I name the fields the same as the default day, month, year, time, etc or does is matter?
I hate to duplicate fields that splunk is already trying to extract or is there a way to disable the automatic date/time extraction for events? What is recommended?
You could just specify your custom time extraction in props.conf
Use the TIME_FORMAT property to specify a strptime pattern for your events.