unable to extract timestamp till nano seconds

ips_mandar — Wed, 16 Sep 2020 10:36:47 GMT

Hi
I am trying to extract timestamp including nanoseconds but I am able to extract only 7 digits of nanoseconds though I used %9N in TIME_FORMAT.
Below is my sample event-

10,11/03/20 04:00:00.00000010,11/03/20,04:00:00,Zx: 6037,04:00:00,48d4c21c3014850838840a460424c05b20412128053ce6074720006e00f1ff5500000000000000,Mod=2,AckReq=0,RtBits=0,MsgSeq=35,OnRte=1,Id=46,VId=6037

Below is my props.conf -

[abc_logs_st] LINE_BREAKER = ([\r\n]+) SHOULD_LINEMERGE = false NO_BINARY_CHECK = true category = Custom pulldown_type = 1 disabled = false TIME_PREFIX = ^\d+\, MAX_TIMESTAMP_LOOKAHEAD = 30 TIME_FORMAT = %m/%d/%y %H:%M:%S.%9N

Why Splunk is considering only 7 digits after decimal..Is this bug in Splunk?

Thanks.

Re: unable to extract timestamp till nano seconds

richgalloway — Tue, 15 Sep 2020 18:05:45 GMT

The example event has only 8 digits after the decimal.

Re: unable to extract timestamp till nano seconds

ips_mandar — Wed, 16 Sep 2020 05:16:00 GMT

@richgalloway No this won't help.
Even if I include 9 digits after decimal still splunk was able to extract 7 digits only .
Is this bug with Splunk?

topic unable to extract timestamp till nano seconds in Splunk Enterprise

unable to extract timestamp till nano seconds

Re: unable to extract timestamp till nano seconds

Re: unable to extract timestamp till nano seconds