Splunks date_* fields not in all records

[JensT]

Hi,

Splunk 4.3.6 (UF, HF, Idx and Srh)

Why are the date_* fields not in all records?

Regards,
Jens

[Ayn]

(from @lguinn's answer in http://answers.splunk.com/answers/99451/variance-betweeen-_time-and-date_-fields )

The date_* fields are a direct parsing of the text timestamp in the input stream. These fields do not exist for inputs that do not use text timestamps; for example, none of them will appear in an input that uses Linux epoch time.

In other words, you should not rely on them being there.

[Ayn]

I totally agree. 🙂

[JensT]

Hi,

thanks for the speedy answer. So i consider this as a design flaw.
We have billions of records with these fields (Linux, Unix, Solaris) and millions without (Windows Event Logs).

Its confusing to users and will be hard to explain this, but at least we know that we cannot rely on them.

Regards and thanks,

Jens