topic Re: TIME_FORMAT Ignoring Milliseconds in Getting Data In

TIME_FORMAT Ignoring Milliseconds

llow — Wed, 04 Sep 2013 20:30:44 GMT

I'm having problems getting Splunk (through data preview) from correctly parsing the following timestamp:

2013.08.14 12:47:02:467 MST

I am using the format below but the milliseconds are ignored and Splunk shows '8/14/13 12:47:02.000 PM' instad of '8/14/13 12:47:02.467 PM'

TIME_FORMAT=%Y.%m.%d %H:%M:%S:%3N %Z

Re: TIME_FORMAT Ignoring Milliseconds

rturk — Wed, 04 Sep 2013 23:01:44 GMT

Hi Llow,

Your TIME_FORMAT looks OK. Is the timestamp that's being parsed at the start or mid-way through an event?

One thing I've noticed with the data preview is that sometimes the preview doesn't fully extract the timestamp, while submitting the change and viewing it in Splunk proper will. I found this quite recently helping out with this question:

http://answers.splunk.com/answers/101487/striptime-not-parsing-time-stamps

The milliseconds were not detected in the preview, but were fine once put into Splunk.

I'd recommend throwing your data into a test index to confirm for yourself.

Hope this helps 🙂

Re: TIME_FORMAT Ignoring Milliseconds

llow — Mon, 28 Sep 2020 14:42:40 GMT

The timestamp is at the very beginning of a multi-line event. I have also played with TIME_PREFIX and MAX_TIMESTAMP_LOOKAHEAD without luck.

The current config I have is:

NO_BINARY_CHECK=1
BREAK_ONLY_BEFORE_DATE=true
CHARSET=ISO-8859-1
LEARN_SOURCETYPE=true
SHOULD_LINEMERGE=true
TIME_FORMAT=%Y.%m.%d %H:%M:%S:%3N %Z
TIME_PREFIX=^
MAX_TIMESTAMP_LOOKAHEAD=27

I've tried uploading a file into the index to make sure it wasn't a problem with the data previewer but it still comes in without the milliseconds.

Re: TIME_FORMAT Ignoring Milliseconds

rturk — Thu, 05 Sep 2013 00:25:16 GMT

Can you edit your original question to include two or three redacted sample events?