How can I get timestamp differences to a tenth of a second?

[scottecclestone]

I'm calculating the time differences between web requests with this part of my query:
| streamstats range(_time) as Interval window=2
| chart count by Interval
| fillnull value=0
However, the Interval Splunk uses is one (1) second. I'd prefer accuracy to a tenth of a second, but can't figure out how to do that.

[DalJeanis]

Okay, first, given that query, your intervals are between consecutive events, going backwards in time (because the events are returned most recent first.) This is probably fine, since range() doesn't care whether the difference is positive or negative.

Second, you should start off by checking whether there are sub-second _times represented on the events. Splunk can't give you data that isn't there. Here's a quick and dirty test. If it returns ANYTHING, then you have subsecond times. If not, then you don't.

  | your base query 
  | eval eval subseconds= _time - round(_time,0)
  | where subseconds!=0

Now, if you DO have subsecond granularity already, then your calculation above should have worked. So, if NO records come out of that query, then you have a timestamp problem.

Look at the _raw to verify that the timestamp has subsecond values.

If the event does not have subsecond values, then you are asking for something that does not exist.

If the event does not have subsecond values, then we need to figure out your timestamp parsing issue. In that case, please post the contents of the props.conf stanza for the relevant sourcetype.

http://docs.splunk.com/Documentation/Splunk/7.0.3/Data/Configuretimestamprecognition

[adonio]

do you record milliseconds in your tiimestamp of the events?
if you do, you probably would like to change your tine settings in props.conf
if you dont, then you probably want to add it to your data