Enabling Milliseconds time stamp in splunk

[waytoavnish]

I have multiple log files with different sources which log time stamp in different formats as below. In one the cases (CASE 2) I am lossing millisecond precision in splunk. Can some one tell which configuration needs to be changed here and if thet configuration needs to be changed at source type level or some universal setting will handle all issues?

Case 1 (Millisecond timestamp is preserved)
[2018-04-04 00:26:10,649][ERROR][shield.action ] *********
Splunk Time Stamp = 4/4/18 12:26:10.649 AM

====================================
Case 2 (Millisecond timestamp lost)

RAW LOG : 2018-04-04 00:29:02,183 INFO response - 2018-04-04 00:29:02,183 *******

Splunk Timestamp :4/4/18 12:29:02.000 AM

Case 3 (Millisecond timestamp is preserved)

RAW log:2018-04-04 00:31:09.118 c.e.f.f.c.p.B**************
SPlunk Time stamp : 4/4/18 12:31:09.118 AM

[mayurr98]

Well you can do that in props.conf and mainly you need to put TIME_FORMAT and TIME_PREFIX in order to do timestamp configuration.

Refer this doc for more information.
http://docs.splunk.com/Documentation/Splunk/7.0.3/Data/Configuretimestamprecognition

let me know if this helps!