Splunk Search

How does Splunk create the date_month field?

Path Finder

Since day 23 so far, Splunk is not creating the date_month.
It has not changed the date model is the same, as I verified it.
I wonder how Splunk creates the date month for me to identify the problem.

Thanks!!

0 Karma
1 Solution

Esteemed Legend

Splunk only creates the date_* fields when it is normalizing the event date to GMT. If Splunk now thinks that your events are arriving already in GMT, then it will not do the normalization, so the GMT-normalization artifacts will not be created. What changed such that Splunk thinks your events are in UTC/GMT?

View solution in original post

0 Karma

Esteemed Legend

Splunk only creates the date_* fields when it is normalizing the event date to GMT. If Splunk now thinks that your events are arriving already in GMT, then it will not do the normalization, so the GMT-normalization artifacts will not be created. What changed such that Splunk thinks your events are in UTC/GMT?

View solution in original post

0 Karma

Path Finder

Hello, so I did not really change anything, the logs that work come from a machine, it may be a problem there!

Thank you!!

0 Karma