topic Re: WinEventLog Milli seconds identification. in Getting Data In

WinEventLog Milli seconds identification.

thirumalreddyb — Thu, 08 Jun 2017 10:24:45 GMT

Splunk is not parsing the milliseconds into _time field. How to parse it during the index time?

I have updated my TIME_FORMAT in props in all the search peers; yet it is not parsing properly.

Thanks in advance.

Re: WinEventLog Milli seconds identification.

teunlaan — Thu, 08 Jun 2017 11:55:54 GMT

Does you WinEventLog have milliseconds in the timestamp?

Re: WinEventLog Milli seconds identification.

thirumalreddyb — Thu, 08 Jun 2017 12:06:07 GMT

Yes, this is that format => %Y-%m-%dT%H:%M:%S.%9NZ

Re: WinEventLog Milli seconds identification.

teunlaan — Thu, 08 Jun 2017 12:19:41 GMT

so if you do index=windows| table _raw You also see the milliseconds in the message?

how do you collect the Wineventlog? "normal" or by xml?

Re: WinEventLog Milli seconds identification.

thirumalreddyb — Thu, 08 Jun 2017 12:22:38 GMT

We collect them in xml format.

Re: WinEventLog Milli seconds identification.

thirumalreddyb — Sun, 11 Jun 2017 06:30:28 GMT

I downvoted this post because this is not an answer. this prevented others from looking into the question.

Re: WinEventLog Milli seconds identification.

hettervik — Tue, 29 Sep 2020 17:59:58 GMT

Hi. Did you find out why your parsing for WinEventLog doen't extract the milliseconds? I seem to have the same problem. I've sat TIME_FORMAT in props.conf, but still it seems to be ignored. Also I've checked using the data onboarding UI in Splunk that the TIME_FORMAT setting is indeed correct for the logs.

Re: WinEventLog Milli seconds identification.

hettervik — Mon, 12 Feb 2018 12:36:09 GMT

After looking some more into the problem with Splunk not extracting milliseconds from WinEventLog, I found this thread:

https://answers.splunk.com/answers/489938/splunk-add-on-for-microsoft-windows-why-is-timesta.html

It seems to be the answer for your question. Unfortunately the timestamp for WinEventLog is parsed at input time, and cannot be corrected later on at indexs time.