topic Splunk not storing time in milliseconds in Monitoring Splunk

Splunk not storing time in milliseconds

ankith_nt — Wed, 08 Aug 2018 19:40:52 GMT

I am extracting the timestamp from events in microseconds (%Y-%m-%d:%H:%M:%S.%6N). But when index event timestamp is not showing in sub seconds. Always I see zeroth subsecond in timestamp. Is there any overwritten possible other than by props?

Re: Splunk not storing time in milliseconds

kmorris_splunk — Wed, 08 Aug 2018 20:25:37 GMT

I think this is just a question of how Splunk shows _time. Try something like this to see if it helps.

<YOUR BASE SEARCH> 
| convert timeformat="%Y-%m-%d %H:%M:%S:%6N" ctime(_time) AS c_time 
| table c_time