Splunk Search

Extracting Date Fields

sseekamp
Explorer

If I am doing custom field extraction on an event should I name the fields the same as the default day, month, year, time, etc or does is matter?

I hate to duplicate fields that splunk is already trying to extract or is there a way to disable the automatic date/time extraction for events? What is recommended?

Tags (3)
0 Karma

Damien_Dallimor
Ultra Champion

You could just specify your custom time extraction in props.conf

http://docs.splunk.com/Documentation/Splunk/latest/admin/propsconf

Use the TIME_FORMAT property to specify a strptime pattern for your events.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...