Can splunk extract timestamp till nano seconds

ips_mandar — Fri, 18 Sep 2020 17:14:08 GMT

Hi
I am trying to extract timestamp including nanoseconds but I am able to extract only 7 digits of nanoseconds though I used %9N in TIME_FORMAT.
Below is my sample event-

10,11/03/20 04:00:00.000000010,11/03/20,04:00:00,Zx: 6037,04:00:00,48d4c21c3014850838840a460424c05b20412128053ce6074720006e00f1ff5500000000000000,Mod=2,AckReq=0,RtBits=0,MsgSeq=35,OnRte=1,Id=46,VId=6037

Below is my props.conf -

[abc_logs_st] LINE_BREAKER = ([\r\n]+) SHOULD_LINEMERGE = false NO_BINARY_CHECK = true category = Custom pulldown_type = 1 disabled = false TIME_PREFIX = ^\d+\, MAX_TIMESTAMP_LOOKAHEAD = 30 TIME_FORMAT = %m/%d/%y %H:%M:%S.%9N

Why Splunk is considering only 7 digits after decimal..Is this bug in Splunk?

Thanks.

Re: Can splunk extract timestamp till nano seconds

isoutamo — Fri, 18 Sep 2020 17:43:56 GMT

Yes splunk can extract it to ms. Your data an props seems to be correct. You can test it with splunk by trying to add this data with splunk and use Setyings -> add data -> files and directories -> monitor. Then you can evaluate/check that props with your data and try to find what needs to change.
r. Ismo

topic Can splunk extract timestamp till nano seconds in Getting Data In

Can splunk extract timestamp till nano seconds

Re: Can splunk extract timestamp till nano seconds