topic Re: go's time.RFC3339Nano format in Getting Data In

go's time.RFC3339Nano format

framirez_enova — Fri, 11 Sep 2020 15:53:07 GMT

Anyone having issues with nano second formatting from JSON logs. Currently it seems like times get rounded up or something.

What's sent: 2020-09-11T10:23:44.30373164-05:00
What shows: 9/11/20 10:23:44.000 AM

If you have/experienced this issue, how are you coping with or how did you solved it?

Re: go's time.RFC3339Nano format

isoutamo — Fri, 11 Sep 2020 17:05:40 GMT

I think that _time field can show it only ms not with more digits. If you want see all then you must convert it to anther field e.g. eval fullTime = strftime(_time, “%FT%T.%8N%:z”)
You have only 8 digits on your example even ns have 9, maybe this can also affect here?

Re: go's time.RFC3339Nano format

framirez_enova — Tue, 15 Sep 2020 18:52:56 GMT

Interesting on the digit. Will keep that in mind. I also reached out to splunk support and they advise to try this in the props.conf file for the source:

%Y-%m-%dT%H:%M:%S.%9N%:z

Re: go's time.RFC3339Nano format

isoutamo — Wed, 16 Sep 2020 05:31:45 GMT

%F <=> %Y-%m-%d
%T <=> %H:%M:%S

Please check your source is there eight or nine digits and use based on that %8N or %9N otherwise this didn't work.