Getting Data In

ADD_EXTRA_TIME_FIELDS=false leads to missing milliseconds

exmuzzy
Explorer

I have such props.conf

[api]
TZ = Europe/Moscow
MAX_TIMESTAMP_LOOKAHEAD = 25
BREAK_ONLY_BEFORE = ^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2},\d{3}
BREAK_ONLY_BEFORE_DATE = true
TIME_PREFIX = ^
MAX_EVENTS = 5000
CHARSET = AUTO
KV_MODE = none
NO_BINARY_CHECK = true
category = Application
description = CamelAPI
TRANSFORMS-result = result

And events like

2017-11-01 10:38:01,814 [20    ] 
----------------------------
requestID=Server&1509521881805-1676215
messageID=MetroRequest@1509521881806-1029061
actor=Asop->
api=AsopApi
method=asop_wr_start
type=response
elapsed=0.009
cardUID=04666B4AC34C80
cardNumber=0014175389
trxID=171100000226854667
trxPCID=72000DBDCC267407DB021DA042E4B268
session=136597463

And splunk recognize milliseconds until I add in my props.conf
ADD_EXTRA_TIME_FIELDS = false

After this every events apperars with time with zero milliseconds

0 Karma

ekost
Splunk Employee
Splunk Employee

In Splunk Enterprise 7.0.0 through 7.2.x, the configuration ADD_EXTRA_TIME_FIELDS also controls the extraction of sub-second timestamps in events. If you set ADD_EXTRA_TIME_FIELDS to false, you prevent sub-second extractions and the creation of time_* fields. See: Enhanced strptime() support.

In Splunk Enterprise 7.3.0 and later, a third setting was created for the ADD_EXTRA_TIME_FIELDS configuration that allows the extraction sub-second timestamps in events while blocking the creation of additional time_* fields. See: Timestamp extraction configuration in props.conf.

0 Karma

DalJeanis
Legend

Tell it your specific time format and see if it straightens up.

TIME_FORMAT = %Y-%m-%d %H:%M:$S,%3Q 
0 Karma

exmuzzy
Explorer

I added it, but it doesn't work
milliseconds still missing

[api]
TZ = Europe/Moscow
MAX_TIMESTAMP_LOOKAHEAD = 25
BREAK_ONLY_BEFORE = ^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2},\d{3}
BREAK_ONLY_BEFORE_DATE = true
TIME_PREFIX = ^
MAX_EVENTS = 5000
CHARSET = AUTO
KV_MODE = none
NO_BINARY_CHECK = true
category = Application
description = CamelAPI
TRANSFORMS-result = result
ADD_EXTRA_TIME_FIELDS = false
TIME_FORMAT = %Y-%m-%d %H:%M:$S,%3Q
0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...