topic Discrepancy in calculation with Time Stamp. in Splunk Enterprise

Discrepancy in calculation with Time Stamp.

sivakrishna — Mon, 23 Oct 2023 17:40:12 GMT

Hi Team,

We are observing discrepancy in calculation when the timestamp is less the 100ms.

Example:

Response time: “2023-10-23 14:46:14.84”

Request time: “2023-10-23 14:46:13.948”

When “Response time – Request time” value should be “136ms” but in Splunk it showing as “890ms”.

While calculating Splunk is considering inbound value as ““2023-10-23 14:46:14.840ms” instead of “.84ms” as its in 2 digits.

So, is there any possibility to resolve this discrepancy from the Splunk query level or .conf level.

Regards,

Siva.

Re: Discrepancy in calculation with Time Stamp.

richgalloway — Mon, 23 Oct 2023 18:32:38 GMT

".84" is correctly interpreted as ".840". Zero padding is always on the side away from the decimal. The difference between the two timestamps is 892ms.

If the application reporting the event intended the timestamp to be "14.084" then it should be corrected.

Re: Discrepancy in calculation with Time Stamp.

PickleRick — Tue, 24 Oct 2023 14:07:33 GMT

+1 on that. Why in what system should 14.84 ever mean 14.084? That's what leading zeros are for. It's definitely an application error.

Also - where do you get that value from? It's the _time field or some other time? While the app should be fixed either way, if it's the main timestamp of the event, it's simply plain wrong in terms of it being the proper timestamp for the event.