19 digit epoch time not being honored

jtm7x2 — Tue, 13 Aug 2024 17:33:34 GMT

I have a field called eventtime in my logs, but the time is 19 characters long in epoch time (which goes to nanoseconds). The field is in the middle of the events, but I want to use it as the timestamp. However, when I, through the UI, define the TIME_PREFIX, it won't recognize it. However, there is another field that also has epoch time, but only 10 characters. When I use it, it works...just doesn't give me the nanoseconds. So, it's not a syntax issue. There are no periods in the timestamp. How can I fix this - using the UI for testing is easier to get feedback, but if I need to modify it in props.conf, that's fine?

Additional context:

The data comes in in json format, but only uses single quotes. I fixed this by using sedcmd in props.conf to swap the single quote with double quotes. In the TIME_PREFIX box (again, in the UI), I used single quotes as double quotes didn't work (which makes sense).

'eventtime': '1707613171105400540'

'itime_t': 1707613170'

Re: 19 digit epoch time not being honored

bowesmana — Tue, 13 Aug 2024 23:24:37 GMT

Have you tried setting TIME_FORMAT in props.conf, e.g.

TIME_FORMAT = %s%9Q

I suspect you won't get nanoseconds, but you should get microseconds, for example this can get microseconds

| makeresults | eval tf="1707613171105412540" | eval t=strptime(tf, "%s%9Q")

topic 19 digit epoch time not being honored in Knowledge Management

19 digit epoch time not being honored

Re: 19 digit epoch time not being honored