How to extract timestamps with milliseconds that have a difference in the number of digits.?

[yutaka1005]

I have below logs.

Wed May 15 13:00:00.4 ... (*it is 4miliseconds)
Wed May 15 13:00:00.82 ... (*it is 82miliseconds)
Wed May 15 13:00:00.110 ... (*it is 110miliseconds)

But these logs's timestamp are extracted like below.

2019 5/15 13:00:00.400 ... (*actually, it is 4miliseconds)
2019 5/15 13:00:00.820 ... (*actually, it is 82miliseconds)
2019 5/15 13:00:00.110 ... (*actually, it is 110miliseconds)

Is there workaround to extract such timestamps in right way?
If someone know about it, please tell me.

Thank you.

[woodcock · Accepted solution]

The problem is actually in how milliseconds work, not in how Splunk works. For your examples:

Wed May 15 13:00:00.4   ... (*it is 400 miliseconds)
Wed May 15 13:00:00.82  ... (*it is 820 miliseconds)
Wed May 15 13:00:00.110 ... (*it is 110 miliseconds)

Going the other way:

Wed May 15 13:00:00.004 ... (*it is   4 miliseconds)
Wed May 15 13:00:00.082 ... (*it is  82 miliseconds)
Wed May 15 13:00:00.110 ... (*it is 110 miliseconds)

So almost certainly everything is A-OK.

[harsmarvania57]

Is this timestamp from Database using DB Connect ?