Splunk Search

How does Splunk create the date_month field?

renanprado96
Path Finder

Since day 23 so far, Splunk is not creating the date_month.
It has not changed the date model is the same, as I verified it.
I wonder how Splunk creates the date month for me to identify the problem.

Thanks!!

0 Karma
1 Solution

woodcock
Esteemed Legend

Splunk only creates the date_* fields when it is normalizing the event date to GMT. If Splunk now thinks that your events are arriving already in GMT, then it will not do the normalization, so the GMT-normalization artifacts will not be created. What changed such that Splunk thinks your events are in UTC/GMT?

View solution in original post

0 Karma

woodcock
Esteemed Legend

Splunk only creates the date_* fields when it is normalizing the event date to GMT. If Splunk now thinks that your events are arriving already in GMT, then it will not do the normalization, so the GMT-normalization artifacts will not be created. What changed such that Splunk thinks your events are in UTC/GMT?

0 Karma

renanprado96
Path Finder

Hello, so I did not really change anything, the logs that work come from a machine, it may be a problem there!

Thank you!!

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...