https://community.splunk.com/t5/Getting-Data-In/Splunk-timestamp-Milliseconds-vs-Microseconds/m-p/461016#M79567 <P>Hi All, <BR /> What would be the impact if i use "%Q" rather than "%6Q" ? <BR /> Cause i'm seeing a 20min time delay on Splunk ingestion, is this because of this or not ?</P> <P><STRONG>Log Example:</STRONG> <BR /> - 2020-03-08-15.31.10.838384<BR /> - 2020-02-01-18.25.15.738385</P> <P><A href="https://docs.splunk.com/Documentation/Splunk/8.0.2/SearchReference/Commontimeformatvariables">https://docs.splunk.com/Documentation/Splunk/8.0.2/SearchReference/Commontimeformatvariables</A><BR /> <A href="https://docs.splunk.com/Documentation/Splunk/8.0.2/Troubleshooting/Troubleshootingeventsindexingdelay">https://docs.splunk.com/Documentation/Splunk/8.0.2/Troubleshooting/Troubleshootingeventsindexingdelay</A></P> Mon, 30 Mar 2020 08:36:38 GMT jadengoho 2020-03-30T08:36:38Z https://community.splunk.com/t5/Getting-Data-In/Splunk-timestamp-Milliseconds-vs-Microseconds/m-p/461016#M79567 <P>Hi All, <BR /> What would be the impact if i use "%Q" rather than "%6Q" ? <BR /> Cause i'm seeing a 20min time delay on Splunk ingestion, is this because of this or not ?</P> <P><STRONG>Log Example:</STRONG> <BR /> - 2020-03-08-15.31.10.838384<BR /> - 2020-02-01-18.25.15.738385</P> <P><A href="https://docs.splunk.com/Documentation/Splunk/8.0.2/SearchReference/Commontimeformatvariables">https://docs.splunk.com/Documentation/Splunk/8.0.2/SearchReference/Commontimeformatvariables</A><BR /> <A href="https://docs.splunk.com/Documentation/Splunk/8.0.2/Troubleshooting/Troubleshootingeventsindexingdelay">https://docs.splunk.com/Documentation/Splunk/8.0.2/Troubleshooting/Troubleshootingeventsindexingdelay</A></P> Mon, 30 Mar 2020 08:36:38 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-timestamp-Milliseconds-vs-Microseconds/m-p/461016#M79567 jadengoho 2020-03-30T08:36:38Z https://community.splunk.com/t5/Getting-Data-In/Splunk-timestamp-Milliseconds-vs-Microseconds/m-p/461017#M79568 <P>Using the wrong time variable may prevent Splunk from matching your data. At best, it will only accept 3 decimal places.<BR /> Since <CODE>%Q</CODE> is the same as <CODE>%3Q</CODE>, which does not match microseconds, you should use <CODE>%6Q</CODE>.</P> <P>I doubt this explains the 20-minute delay, however. Have you verified the clocks are correct on all systems?</P> Mon, 30 Mar 2020 12:50:08 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-timestamp-Milliseconds-vs-Microseconds/m-p/461017#M79568 richgalloway 2020-03-30T12:50:08Z https://community.splunk.com/t5/Getting-Data-In/Splunk-timestamp-Milliseconds-vs-Microseconds/m-p/461018#M79569 <P>Yes the clocks are correct, maybe it's due to other stuff on their server.<BR /> Thanks.</P> Tue, 31 Mar 2020 02:16:07 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-timestamp-Milliseconds-vs-Microseconds/m-p/461018#M79569 jadengoho 2020-03-31T02:16:07Z