Getting Data In

## How to extract timestamps with milliseconds that have a difference in the number of digits.?

Builder

I have below logs.

``````Wed May 15 13:00:00.4 ... (*it is 4miliseconds)
Wed May 15 13:00:00.82 ... (*it is 82miliseconds)
Wed May 15 13:00:00.110 ... (*it is 110miliseconds)
``````

But these logs's timestamp are extracted like below.

``````2019 5/15 13:00:00.400 ... (*actually, it is 4miliseconds)
2019 5/15 13:00:00.820 ... (*actually, it is 82miliseconds)
2019 5/15 13:00:00.110 ... (*actually, it is 110miliseconds)
``````

Is there workaround to extract such timestamps in right way?

Thank you.

Tags (3)
1 Solution
Esteemed Legend

The problem is actually in how milliseconds work, not in how Splunk works. For your examples:

``````Wed May 15 13:00:00.4   ... (*it is 400 miliseconds)
Wed May 15 13:00:00.82  ... (*it is 820 miliseconds)
Wed May 15 13:00:00.110 ... (*it is 110 miliseconds)
``````

Going the other way:

``````Wed May 15 13:00:00.004 ... (*it is   4 miliseconds)
Wed May 15 13:00:00.082 ... (*it is  82 miliseconds)
Wed May 15 13:00:00.110 ... (*it is 110 miliseconds)
``````

So almost certainly everything is A-OK.

Esteemed Legend

The problem is actually in how milliseconds work, not in how Splunk works. For your examples:

``````Wed May 15 13:00:00.4   ... (*it is 400 miliseconds)
Wed May 15 13:00:00.82  ... (*it is 820 miliseconds)
Wed May 15 13:00:00.110 ... (*it is 110 miliseconds)
``````

Going the other way:

``````Wed May 15 13:00:00.004 ... (*it is   4 miliseconds)
Wed May 15 13:00:00.082 ... (*it is  82 miliseconds)
Wed May 15 13:00:00.110 ... (*it is 110 miliseconds)
``````

So almost certainly everything is A-OK.

SplunkTrust

Is this timestamp from Database using DB Connect ?

.conf21 CFS Extended through 5/20!

### Don't miss your chance to share your Splunk wisdom in-person or virtually at .conf21!Call for Speakers hasbeen extended throughThursday, 5/20! Submit Now! >

Get Updates on the Splunk Community!