How do I parse Json logs in miliseconds?

prateeksawhney — Tue, 16 Aug 2022 13:45:12 GMT

Hi All,

I am having issues with parsing of JSON logs time format in miliseconds.

This is the format of my JSON logs.

{"l":1239,"t":1660632134927,"publicationMode":"NORMAL","sequenceTime":3,"requestRead":0,"returnCode":200,"ownerName":"ihsmarkit_uxssd_inbound","payload":500,"requestId":"8fe635c7-f375-466d-aa24-a9abf9512d74","entityName":"Session","publication":5,"serverTime":12,"persist":4,"deserialize":0,"mergeTime":0,"eventId":"P81.1660632134.005","headers":{"Accept":"application\/json","resource":"\/uxssd\/Session","Connection":"close","User-Agent":"Jetty\/9.4.21.v20190926","X-Forwarded-For":"10.186.77.134","Host":"feed.dev.datadelivery.info","Accept-Encoding":"gzip","Content-Length":"1607","X-Real-IP":"10.186.77.134","Content-Type":"multipart\/form-data; boundary=JettyHttpClientBoundary199ah6aq27cmi5vr"},"method":"POST","ip":"10.186.77.134","accountUniqueId":"259B35941636A89528C138288A05","format":"JSON","requestOutcome":"SUCCESS","sessionId":"2A7460F81829F7912DC0E7192B0263844A275FBC0ACE195***@dv11","params":{"data":"Bytes:500","apiKey":"2A7460F81829F7912DC0E7192B0263844A275FBC0ACE195***@dv11","dataFormat":"JSON","httpMethod":"POST","messageType":"MERGE","requestId":"8fe635c7-f375-466d-aa24-a9abf9512d74","dictionaryVersion":"1","entity":"Session"},"processed":1,"sequence":9250657,"validationTime":0,"entities":{"Session":1},"success":true,"namespace":"uxssd"}

In this first line we can see the time format which is "t":1660632134927

and this is my current props.conf.

[json]
TIME_FORMAT = %s%3N
TIME_PREFIX = t:\s+
MAX_TIMESTAMP_LOOKAHEAD = 300
BREAK_ONLY_BEFORE_DATE = true
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
TRUNCATE = 200000
LINE_BREAKER = ^\{
description = mon-4637
disabled = false

Time extraction is happening properly with miliseconds are not getting extracted as expected.

This is the current output - 8/16/22 6:42:14.000 AM

But ideally it should be with miliseconds like example - 8/16/22 6:42:14.927 AM

Please sugesst what changes I need to do in my props.conf so that miliseconds are also visible in time Splunk Event.

Any help here will be highly appreciated.

topic How do I parse Json logs in miliseconds? in Getting Data In

How do I parse Json logs in miliseconds?