Getting Data In

ADD_EXTRA_TIME_FIELDS=false leads to missing milliseconds

exmuzzy
Explorer

I have such props.conf

[api]
TZ = Europe/Moscow
MAX_TIMESTAMP_LOOKAHEAD = 25
BREAK_ONLY_BEFORE = ^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2},\d{3}
BREAK_ONLY_BEFORE_DATE = true
TIME_PREFIX = ^
MAX_EVENTS = 5000
CHARSET = AUTO
KV_MODE = none
NO_BINARY_CHECK = true
category = Application
description = CamelAPI
TRANSFORMS-result = result

And events like

2017-11-01 10:38:01,814 [20    ] 
----------------------------
requestID=Server&1509521881805-1676215
messageID=MetroRequest@1509521881806-1029061
actor=Asop->
api=AsopApi
method=asop_wr_start
type=response
elapsed=0.009
cardUID=04666B4AC34C80
cardNumber=0014175389
trxID=171100000226854667
trxPCID=72000DBDCC267407DB021DA042E4B268
session=136597463

And splunk recognize milliseconds until I add in my props.conf
ADD_EXTRA_TIME_FIELDS = false

After this every events apperars with time with zero milliseconds

0 Karma

ekost
Splunk Employee
Splunk Employee

In Splunk Enterprise 7.0.0 through 7.2.x, the configuration ADD_EXTRA_TIME_FIELDS also controls the extraction of sub-second timestamps in events. If you set ADD_EXTRA_TIME_FIELDS to false, you prevent sub-second extractions and the creation of time_* fields. See: Enhanced strptime() support.

In Splunk Enterprise 7.3.0 and later, a third setting was created for the ADD_EXTRA_TIME_FIELDS configuration that allows the extraction sub-second timestamps in events while blocking the creation of additional time_* fields. See: Timestamp extraction configuration in props.conf.

0 Karma

DalJeanis
Legend

Tell it your specific time format and see if it straightens up.

TIME_FORMAT = %Y-%m-%d %H:%M:$S,%3Q 
0 Karma

exmuzzy
Explorer

I added it, but it doesn't work
milliseconds still missing

[api]
TZ = Europe/Moscow
MAX_TIMESTAMP_LOOKAHEAD = 25
BREAK_ONLY_BEFORE = ^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2},\d{3}
BREAK_ONLY_BEFORE_DATE = true
TIME_PREFIX = ^
MAX_EVENTS = 5000
CHARSET = AUTO
KV_MODE = none
NO_BINARY_CHECK = true
category = Application
description = CamelAPI
TRANSFORMS-result = result
ADD_EXTRA_TIME_FIELDS = false
TIME_FORMAT = %Y-%m-%d %H:%M:$S,%3Q
0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...