Getting Data In

ADD_EXTRA_TIME_FIELDS=false leads to missing milliseconds

exmuzzy
Explorer

I have such props.conf

[api]
TZ = Europe/Moscow
MAX_TIMESTAMP_LOOKAHEAD = 25
BREAK_ONLY_BEFORE = ^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2},\d{3}
BREAK_ONLY_BEFORE_DATE = true
TIME_PREFIX = ^
MAX_EVENTS = 5000
CHARSET = AUTO
KV_MODE = none
NO_BINARY_CHECK = true
category = Application
description = CamelAPI
TRANSFORMS-result = result

And events like

2017-11-01 10:38:01,814 [20    ] 
----------------------------
requestID=Server&1509521881805-1676215
messageID=MetroRequest@1509521881806-1029061
actor=Asop->
api=AsopApi
method=asop_wr_start
type=response
elapsed=0.009
cardUID=04666B4AC34C80
cardNumber=0014175389
trxID=171100000226854667
trxPCID=72000DBDCC267407DB021DA042E4B268
session=136597463

And splunk recognize milliseconds until I add in my props.conf
ADD_EXTRA_TIME_FIELDS = false

After this every events apperars with time with zero milliseconds

0 Karma

ekost
Splunk Employee
Splunk Employee

In Splunk Enterprise 7.0.0 through 7.2.x, the configuration ADD_EXTRA_TIME_FIELDS also controls the extraction of sub-second timestamps in events. If you set ADD_EXTRA_TIME_FIELDS to false, you prevent sub-second extractions and the creation of time_* fields. See: Enhanced strptime() support.

In Splunk Enterprise 7.3.0 and later, a third setting was created for the ADD_EXTRA_TIME_FIELDS configuration that allows the extraction sub-second timestamps in events while blocking the creation of additional time_* fields. See: Timestamp extraction configuration in props.conf.

0 Karma

DalJeanis
Legend

Tell it your specific time format and see if it straightens up.

TIME_FORMAT = %Y-%m-%d %H:%M:$S,%3Q 
0 Karma

exmuzzy
Explorer

I added it, but it doesn't work
milliseconds still missing

[api]
TZ = Europe/Moscow
MAX_TIMESTAMP_LOOKAHEAD = 25
BREAK_ONLY_BEFORE = ^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2},\d{3}
BREAK_ONLY_BEFORE_DATE = true
TIME_PREFIX = ^
MAX_EVENTS = 5000
CHARSET = AUTO
KV_MODE = none
NO_BINARY_CHECK = true
category = Application
description = CamelAPI
TRANSFORMS-result = result
ADD_EXTRA_TIME_FIELDS = false
TIME_FORMAT = %Y-%m-%d %H:%M:$S,%3Q
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...