Getting Data In

How to extract timestamps with milliseconds that have a difference in the number of digits.?

yutaka1005
Builder

I have below logs.

Wed May 15 13:00:00.4 ... (*it is 4miliseconds)
Wed May 15 13:00:00.82 ... (*it is 82miliseconds)
Wed May 15 13:00:00.110 ... (*it is 110miliseconds)

But these logs's timestamp are extracted like below.

2019 5/15 13:00:00.400 ... (*actually, it is 4miliseconds)
2019 5/15 13:00:00.820 ... (*actually, it is 82miliseconds)
2019 5/15 13:00:00.110 ... (*actually, it is 110miliseconds)

Is there workaround to extract such timestamps in right way?
If someone know about it, please tell me.

Thank you.

0 Karma
1 Solution

woodcock
Esteemed Legend

The problem is actually in how milliseconds work, not in how Splunk works. For your examples:

Wed May 15 13:00:00.4   ... (*it is 400 miliseconds)
Wed May 15 13:00:00.82  ... (*it is 820 miliseconds)
Wed May 15 13:00:00.110 ... (*it is 110 miliseconds)

Going the other way:

Wed May 15 13:00:00.004 ... (*it is   4 miliseconds)
Wed May 15 13:00:00.082 ... (*it is  82 miliseconds)
Wed May 15 13:00:00.110 ... (*it is 110 miliseconds)

So almost certainly everything is A-OK.

View solution in original post

0 Karma

woodcock
Esteemed Legend

The problem is actually in how milliseconds work, not in how Splunk works. For your examples:

Wed May 15 13:00:00.4   ... (*it is 400 miliseconds)
Wed May 15 13:00:00.82  ... (*it is 820 miliseconds)
Wed May 15 13:00:00.110 ... (*it is 110 miliseconds)

Going the other way:

Wed May 15 13:00:00.004 ... (*it is   4 miliseconds)
Wed May 15 13:00:00.082 ... (*it is  82 miliseconds)
Wed May 15 13:00:00.110 ... (*it is 110 miliseconds)

So almost certainly everything is A-OK.

View solution in original post

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Is this timestamp from Database using DB Connect ?

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!