Getting Data In

In a log file that has multiple events with the same timestamp, how can each one of these to be ingested as a separate event and insert milliseconds during the indexing time?

JJagadeesh
New Member

Hi,

I have a log file that has multiple events with the same timestamp.
Foe instance:
2018-01-06 00:24:01 - ! [476] Mail is not enabled for agent notifications - xyz
2018-01-06 00:24:01 - ! [476] Mail is not enabled for agent notifications - zbc
2018-01-06 00:24:01 - ! [476] Mail is not enabled for agent notifications - 124
2018-01-06 00:24:01 - ! [476] Mail is not enabled for agent notifications - zbc4
2018-01-06 00:24:01 - ! [476] Mail is not enabled for agent notifications - zbc45g

I would like each one of these to be ingested as a separate event. Looking at the log file there seem to be no milliseconds, how can I insert milliseconds during the indexing time?

OR is there any other way to solve this issue so that the ordering is maintained.
Thanks,
JJ

0 Karma
Get Updates on the Splunk Community!

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...