topic How to extract timestamps with milliseconds that have a difference in the number of digits.? in Getting Data In

How to extract timestamps with milliseconds that have a difference in the number of digits.?

yutaka1005 — Wed, 29 May 2019 09:14:08 GMT

I have below logs.

Wed May 15 13:00:00.4 ... (*it is 4miliseconds)
Wed May 15 13:00:00.82 ... (*it is 82miliseconds)
Wed May 15 13:00:00.110 ... (*it is 110miliseconds)

But these logs's timestamp are extracted like below.

2019 5/15 13:00:00.400 ... (*actually, it is 4miliseconds)
2019 5/15 13:00:00.820 ... (*actually, it is 82miliseconds)
2019 5/15 13:00:00.110 ... (*actually, it is 110miliseconds)

Is there workaround to extract such timestamps in right way?
If someone know about it, please tell me.

Thank you.

Re: How to extract timestamps with milliseconds that have a difference in the number of digits.?

harsmarvania57 — Wed, 29 May 2019 10:06:26 GMT

Is this timestamp from Database using DB Connect ?

Re: How to extract timestamps with milliseconds that have a difference in the number of digits.?

woodcock — Wed, 29 May 2019 15:26:48 GMT

The problem is actually in how milliseconds work, not in how Splunk works. For your examples:

Wed May 15 13:00:00.4   ... (*it is 400 miliseconds)
Wed May 15 13:00:00.82  ... (*it is 820 miliseconds)
Wed May 15 13:00:00.110 ... (*it is 110 miliseconds)

Going the other way:

Wed May 15 13:00:00.004 ... (*it is   4 miliseconds)
Wed May 15 13:00:00.082 ... (*it is  82 miliseconds)
Wed May 15 13:00:00.110 ... (*it is 110 miliseconds)

So almost certainly everything is A-OK.