https://community.splunk.com/t5/Splunk-Search/How-to-recognize-indextime-and-time-as-values-in-subseconds/m-p/189881#M187155 <P>It seems to be better to use splunkit.<BR /> I'll try that.</P> Sat, 28 Dec 2013 12:54:00 GMT sunrise 2013-12-28T12:54:00Z https://community.splunk.com/t5/Splunk-Search/How-to-recognize-indextime-and-time-as-values-in-subseconds/m-p/189879#M187153 <P>Hi Splunkers,</P> <P>I want to know how does it take for splunk to index the data in subseconds?<BR /> So I prepared the following configration file.</P> <P>props.conf</P> <PRE><CODE>[sampledata] DATETIME_CONFIG = CURRENT </CODE></PRE> <P>But in this time, Splunk add timestamps (in this case, system time) in seconds to each events.<BR /> I know that we cannot use "TIME_FORMAT" option together with "DATETIME_CONFIG = CURRENT".<BR /> And in default setting, index date (_indextime field) is also in second order.</P> <P>How can we recognize there fields (_indextime and _time fileds) as values in subsecond order to calculate index time ?</P> <P>Thank you for your help.</P> <HR /> <P>I updated my question below.</P> <P>Splunk logs are recognized as subsecond timeformat events.<BR /> I used these logs to calculate the index time.<BR /> However, default "_indextime" fields don't have subsecond timeformat.<BR /> Can I change this definition to change to subsecond order event.</P> Mon, 28 Sep 2020 15:32:37 GMT https://community.splunk.com/t5/Splunk-Search/How-to-recognize-indextime-and-time-as-values-in-subseconds/m-p/189879#M187153 sunrise 2020-09-28T15:32:37Z https://community.splunk.com/t5/Splunk-Search/How-to-recognize-indextime-and-time-as-values-in-subseconds/m-p/189880#M187154 <P>I got something, so update the my question.<BR /> Splunk logs are recognized as subsecond timeformat event.<BR /> But "_indextime" field is not..<BR /> Can I change this timeformat to subsecond order ?</P> Fri, 27 Dec 2013 00:40:37 GMT https://community.splunk.com/t5/Splunk-Search/How-to-recognize-indextime-and-time-as-values-in-subseconds/m-p/189880#M187154 sunrise 2013-12-27T00:40:37Z https://community.splunk.com/t5/Splunk-Search/How-to-recognize-indextime-and-time-as-values-in-subseconds/m-p/189881#M187155 <P>It seems to be better to use splunkit.<BR /> I'll try that.</P> Sat, 28 Dec 2013 12:54:00 GMT https://community.splunk.com/t5/Splunk-Search/How-to-recognize-indextime-and-time-as-values-in-subseconds/m-p/189881#M187155 sunrise 2013-12-28T12:54:00Z https://community.splunk.com/t5/Splunk-Search/How-to-recognize-indextime-and-time-as-values-in-subseconds/m-p/189882#M187156 <P>You should use SplunkIt as a mesurement for the index and search performance.</P> <P>SplunkIt | Utilities | Splunk Apps <A href="http://apps.splunk.com/app/749/">http://apps.splunk.com/app/749/</A></P> Tue, 07 Jan 2014 04:40:15 GMT https://community.splunk.com/t5/Splunk-Search/How-to-recognize-indextime-and-time-as-values-in-subseconds/m-p/189882#M187156 sunrise 2014-01-07T04:40:15Z