Time dimensions extracting in #Splunk