How does Splunk create the date_month field?

[renanprado96]

Since day 23 so far, Splunk is not creating the date_month.
It has not changed the date model is the same, as I verified it.
I wonder how Splunk creates the date month for me to identify the problem.

Thanks!!

[woodcock · Accepted solution]

Splunk only creates the date_* fields when it is normalizing the event date to GMT. If Splunk now thinks that your events are arriving already in GMT, then it will not do the normalization, so the GMT-normalization artifacts will not be created. What changed such that Splunk thinks your events are in UTC/GMT?

[renanprado96]

Hello, so I did not really change anything, the logs that work come from a machine, it may be a problem there!

Thank you!!