topic Re: sub second event sorting in Getting Data In

sub second event sorting

briang67 — Fri, 24 Sep 2010 20:36:55 GMT

We have a log file which contains a 7 digit second timestamp like the below: 08:30:00.2124216

We periodically need to compare sub second times between events, but it looks like the splunk event _time only includes the first 3 second digits like: 08:30:00.212

the problem is when we do a sort by _time, we frequently see events that are out of order like the following: 08:30:00.2124216 08:30:00.2124215 (this should be the reverse)

Anyone know of a way to handle this? Can splunk be configured to recognize a more granular time stamp?

Re: sub second event sorting

dwaddle — Fri, 24 Sep 2010 20:54:52 GMT

I suggest you check out the TIME_FORMAT option. I had a similar question some time ago:

http://answers.splunk.com/questions/1946/time-format-and-subseconds

Re: sub second event sorting

gkanapathy — Sat, 25 Sep 2010 11:29:43 GMT

You use %7N to capture 7 digits of subseconds.