Getting Data In

How to configure wineventlog on a universal forwarder to include milliseconds in event timestamps?


I'm using a Splunk 6.3.1 Universal Forwarder for Windows to forward a custom event viewer log to a Splunk indexer. Works fine except the timestamps do not have millisecond precision. I used a tcp sniffer to confirm the Windows outbound 9997 packet does not have the milliseconds ( 01/12/2016 06:52:48 PM). Using Windows Event Viewer, I can look at the same EventRecordID event properties and see the millisecond detail IS available ( TimeCreated [ SystemTime] 2016-01-12T23:52:48.196341700Z).

Is there a configuration setting for the Forwarder I can make to send the timestamps with milliseconds?

0 Karma


Hello esmith3,

There are two windows event log views (provided by microsoft, independent of splunk):

  1. The General Tab (everything is in "human language", datetime stamp doesnt have ms)
  2. The XML View (everything is in "machine language" (XML), datetimestampe DOES have ms)

Those details you speak of are in the XML view but you're not using RenderXML = True to see the XML view. Therefore, you're not seeing the milliseconds. WARNING: if you switch to XML view, you'll find other behavior you wont like.

Finally, if this makes you upset make sure you blame M$ not Splunk because Splunk has nothing to do with M$ coding. Well... they did setup shop in washington just to leech talent from M$ so technically some of the Splunk developers might have something to do with event viewer code, but XML vs Human view has been around since pre Windows 2000. So it would be a SR Dev / Architect you'd probably want to blame instead of Splunk as a whole.

0 Karma
Get Updates on the Splunk Community!

Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...

There's No Place Like Chrome and the Splunk Platform

WATCH NOW!Malware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

Customer Experience | Join the Customer Advisory Board!

Are you ready to take your Splunk journey to the next level? 🚀 We invite you to join our elite squad ...